Manuel Trezza

The issue arises when the Parse Server option `allowCustomObjectId: true` is set, allowing an attacker to create a new user with a custom object ID that exploits the vulnerability and acquires privileges of a specific role.

The issue was addressed with additional user controls. Users may be unable to remove metadata indicating where files were downloaded from.