Parse Server GraphQL Configuration and Audience Class Master Key Bypass Vulnerability

A vulnerability in Parse Server prior to versions 9.5.2-alpha.12 and 8.6.25 allows unauthorized access to the internal classes '_GraphQLConfig' and '_Audience' via generic REST API routes. This access can be exploited to read, modify, and delete GraphQL configuration and push audience data, bypassing the master key authentication required on dedicated endpoints. The vulnerability affects versions 9.0.0 prior to 9.5.2-alpha.12 and versions prior to 8.6.25.

Impact

Exploitation of this vulnerability allows for unauthorized reading, modification, and deletion of GraphQL configuration and audience data.

Remediation

Users can upgrade to Parse Server versions 9.5.2-alpha.12 or 8.6.25 to address this vulnerability.