A critical authorization flaw in Parse Server allows unauthenticated attackers to bypass file access controls via specially crafted HTTP Range requests.

The vulnerability exists in the handling of file downloads via HTTP Range requests, which bypass the afterFind (Parse.File) trigger and associated validators on storage adapters that support streaming. This allows an unauthenticated attacker to access protected files that should be restricted by authorization logic or the requireUser validator.

The ability to bypass authorization mechanisms to access sensitive files poses a significant risk to data confidentiality. Unauthorized access to stored files could lead to the exposure of proprietary information, user data, or system configurations. With a CVSS score of 7.5, this vulnerability represents a high-severity risk that requires immediate attention to prevent potential data breaches.

Immediate Action: Update Parse Server to version 8.6.71 or 9.7.1-alpha.1 immediately to incorporate the necessary authorization checks for streaming file downloads.

Proactive Monitoring: Monitor server access logs for anomalous HTTP Range requests targeting file endpoints that exhibit unusual patterns or unauthorized access attempts.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and potentially block HTTP Range headers on requests directed at file storage endpoints if patching is not immediately feasible.

Public Exploit Available: Unknown

Given the potential for unauthorized data exfiltration, administrators should prioritize the deployment of the provided security updates. By upgrading to the patched versions, organizations ensure that the afterFind authorization logic is correctly enforced for all file requests, effectively closing the identified security gap. Failure to patch leaves backend storage exposed to unauthorized retrieval.