Unknown · Parse Server · CVE-2024-47183
**Name of the Vulnerable Software and Affected Versions**
Parse Server versions prior to 6.5.9
Parse Server versions prior to 7.3.0
**Description**
The issue arises when the Parse Server option `allowCustomObjectId: true` is set, allowing an attacker to create a new user with a custom object ID that exploits the vulnerability and acquires privileges of a specific role.
**Recommendations**
For versions prior to 6.5.9, update to version 6.5.9 or later to resolve the issue.
For versions prior to 7.3.0, update to version 7.3.0 or later to resolve the issue.
As a temporary workaround, consider disabling custom object IDs by setting `allowCustomObjectId: false`.
Alternatively, use a Cloud Code Trigger to validate that a new user's object ID doesn't start with the prefix `role:`.