Parse Server versions prior to 7.3.0 with the option allowCustomObjectId set to true are vulnerable to a privilege escalation issue. An attacker who can create a new user can specify a custom object ID that allows them to acquire the privileges of a specific role. This vulnerability has been fixed in versions 6.5.9 and 7.3.0.