Kartal Kaan Bozdoğan

The issue arises when the Parse Server option `allowCustomObjectId: true` is set, allowing an attacker to create a new user with a custom object ID that exploits the vulnerability and acquires privileges of a specific role.

The issue occurs when a query request contains an invalid value for the `explain` option, causing Parse Server to crash due to a bug in the MongoDB Node.js driver that throws an exception Parse Server cannot catch.