Parse Server's routeAllowList option is intended to restrict external client access to configured REST API routes by enforcing checks as Express middleware on the outer HTTP request URL. However, for the /batch handler, which dispatches multiple sub-requests internally, the allow-list check is not re-applied to each sub-request. This allows an external attacker whose outer route matches /batch to issue sub-requests to any REST API route not included in the allow-list, effectively bypassing the route firewall. Despite this bypass, other authorization mechanisms such as authentication, ACL, and CLP remain enforced. The vulnerability affects versions from 9.8.0 up to but excluding 9.9.1-alpha.3 and has been patched in 9.9.1-alpha.3.

An attacker can bypass the operator-configured routeAllowList firewall by sending batch requests, potentially accessing REST API routes that were intended to be restricted. However, the attacker's access is still subject to existing authentication and authorization controls, limiting the impact to bypassing only the routeAllowList restriction.

A fix is available in parse-server version 9.9.1-alpha.3. Users should upgrade to this version or later to address the vulnerability. No other specific mitigation is indicated.