Parse Server versions before 8.6.104 and 9.0.0 before 9.10.5 contain a privilege escalation vulnerability in the SMS multi-factor authentication (MFA) login process. The server saves the entire login request with master privileges when issuing an SMS MFA verification code. This allows an SMS MFA-enrolled user to modify master-key-restricted fields on their own account, such as the email-verification flag or values protected by beforeSave triggers.