CVE-2024-47183: Parse Server Privilege Escalation Vulnerability

CVE-2024-47183 Overview

CVE-2024-47183 is a broken access control vulnerability in Parse Server, an open source Node.js backend framework. When the allowCustomObjectId: true option is enabled, an attacker permitted to create a new user account can supply a custom objectId that begins with the role: prefix. This crafted identifier causes the authentication layer to conflate the user object with a role object, granting the attacker the privileges of that role. The flaw is classified under CWE-285: Improper Authorization and CWE-863: Incorrect Authorization. Fixed releases are Parse Server 6.5.9 and 7.3.0.

Critical Impact
A low-privileged user able to register an account can acquire the privileges of any role in the Parse Server deployment, resulting in unauthorized access to confidential data and the ability to modify protected records.

Affected Products

Parse Server versions prior to 6.5.9 (6.x branch) running on Node.js
Parse Server versions prior to 7.3.0 (7.x branch) running on Node.js
Any Parse Server deployment configured with allowCustomObjectId: true

Discovery Timeline

2024-10-04 - CVE-2024-47183 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-47183

Vulnerability Analysis

Parse Server represents both users and roles as objects stored in the same underlying collection namespace. Roles are conventionally referenced with an identifier prefixed by role:. When administrators enable allowCustomObjectId, clients may specify the objectId value at object creation instead of letting the server generate it.

The authentication and authorization pipeline did not reject _User objects whose objectId began with role:. As a result, an attacker could register a new user with an objectId such as role:admin. Once that user authenticated, the session's user object was interpreted with role semantics by downstream ACL and permission checks, effectively inheriting that role's grants.

Root Cause

The root cause is missing input validation on client-supplied objectId values for _User class creation, combined with an authorization layer that trusts identifier prefixes to distinguish users from roles. Parse Server did not enforce the invariant that user objectId values must not collide with the role identifier namespace.

Attack Vector

Exploitation requires network access to the Parse Server API and the ability to create a user, which is commonly open on deployments accepting registrations. The attacker submits a POST request to the _User endpoint with a JSON body specifying an objectId value of role:<target_role>. After authenticating as that user, subsequent requests are evaluated as if issued by the target role.

javascript

// Security patch in src/Auth.js — rejects sessions whose user objectId
// impersonates a role identifier.
    throw new Parse.Error(Parse.Error.INVALID_SESSION_TOKEN, 'Session token is expired.');
  }
  const obj = session.user;

  if (typeof obj['objectId'] === 'string' && obj['objectId'].startsWith('role:')) {
    throw new Parse.Error(Parse.Error.INTERNAL_SERVER_ERROR, 'Invalid object ID.');
  }

  delete obj.password;
  obj['className'] = '_User';
  obj['sessionToken'] = sessionToken;

// Security patch in src/Routers/ClassesRouter.js — blocks creation of
// _User records whose custom objectId starts with 'role:'.
  handleCreate(req) {
    if (
      this.className(req) === '_User' &&
      typeof req.body?.objectId === 'string' &&
      req.body.objectId.startsWith('role:')
    ) {
      throw new Parse.Error(Parse.Error.OPERATION_FORBIDDEN, 'Invalid object ID.');
    }
    return rest.create(
      req.config,
      req.auth,

Source: parse-community/parse-server commit 13ee52f0 and commit 1bfbccf9.

Detection Methods for CVE-2024-47183

Indicators of Compromise

Records in the _User collection whose objectId field starts with the literal string role:.
HTTP POST requests to /parse/classes/_User or /parse/users containing an objectId value in the request body.
Session tokens tied to a user object whose objectId matches an existing role name.
Access log entries showing privileged operations performed by newly created, low-reputation accounts.

Detection Strategies

Query the MongoDB or Postgres backing store directly for _User documents where objectId begins with role:.
Inspect Parse Server application logs for creation events whose payload includes both className: _User and a client-supplied objectId.
Alert when the server configuration file or environment sets allowCustomObjectId=true on internet-facing deployments.

Monitoring Recommendations

Forward Parse Server access and application logs to a centralized log platform and retain them for post-incident review.
Baseline expected object creation patterns and alert on requests that specify a custom objectId for the _User class.
Track first-use-of-privilege events for newly created accounts to surface unexpected role-level access.

How to Mitigate CVE-2024-47183

Immediate Actions Required

Upgrade Parse Server to 6.5.9 or 7.3.0 or later without delay.
Audit the _User collection for any objectId values beginning with role: and remove or quarantine those accounts.
If upgrade is not immediately possible, set allowCustomObjectId: false in the Parse Server configuration.
Rotate session tokens and force re-authentication after applying the patch.

Patch Information

The fix is delivered in Parse Server 6.5.9 and 7.3.0. See GitHub Security Advisory GHSA-8xq9-g7ch-35hg, Pull Request #9317, and Pull Request #9318. The patch rejects _User creation requests whose objectId starts with role: and invalidates sessions bound to such impersonating identifiers.

Workarounds

Disable custom object IDs by setting allowCustomObjectId: false until the upgrade is complete.
Add a Cloud Code beforeSave trigger on the _User class that rejects any objectId starting with role:.
Restrict user registration to authenticated administrative flows where the objectId cannot be controlled by untrusted clients.

bash

# Upgrade Parse Server to a patched release
npm install parse-server@7.3.0
# or, for the 6.x branch
npm install parse-server@6.5.9

# Verify the installed version
npm ls parse-server