{"id":"CVE-2024-47183","aliases":["BIT-parse-2024-47183","GHSA-8xq9-g7ch-35hg"],"url":"https://o3.security/vulnerability/CVE-2024-47183","summary":"Parse Server's custom object ID allows to acquire role privileges","details":"### Impact\n\nIf the Parse Server option `allowCustomObjectId: true` is set, an attacker that is allowed to create a new user can set a custom object ID for that new user that exploits the vulnerability and acquires privileges of a specific role.\n\n### Patches\n\nImproved validation for custom user object IDs. Session tokens for existing users with an object ID that exploits the vulnerability are now rejected.\n\n### Workarounds\n\n- Disable custom object IDs by setting `allowCustomObjectId: false` or not setting the option which defaults to `false`.\n- Use a Cloud Code Trigger to validate that a new user's object ID doesn't start with the prefix `role:`.\n\n### References\n\n- https://github.com/parse-community/parse-server/security/advisories/GHSA-8xq9-g7ch-35hg\n- https://github.com/parse-community/parse-server/pull/9317 (fix for Parse Server 7)\n- https://github.com/parse-community/parse-server/pull/9318 (fix for Parse Server 6)","published":"2024-10-04T15:06:45.274Z","modified":"2026-08-12T03:51:46.538870948Z","cvss":{"score":8.1,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"parse-server","fixedVersion":"6.5.9"},{"ecosystem":"npm","name":"parse-server","fixedVersion":"7.3.0"}],"fix":{"url":"https://github.com/parse-community/parse-server/commit/13ee52f0d19ef3a3524b3d79aea100e587eb3cfc","label":"parse-community/parse-server@13ee52f"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/47xxx/CVE-2024-47183.json"},{"type":"ADVISORY","url":"https://github.com/parse-community/parse-server/security/advisories/GHSA-8xq9-g7ch-35hg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47183"},{"type":"FIX","url":"https://github.com/parse-community/parse-server/commit/13ee52f0d19ef3a3524b3d79aea100e587eb3cfc"},{"type":"FIX","url":"https://github.com/parse-community/parse-server/commit/1bfbccf9ee7ea77533b2b2aa7c4c69f3bd35e66f"},{"type":"FIX","url":"https://github.com/parse-community/parse-server/pull/9317"},{"type":"FIX","url":"https://github.com/parse-community/parse-server/pull/9318"},{"type":"PACKAGE","url":"https://github.com/parse-community/parse-server"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:46.538870948Z"}}