{"schema":"threatline.record/2","record":{"id":"GHSA-qmg9-m772-5rm7","aliases":["GHSA-qmg9-m772-5rm7"],"summary":"Unauthenticated deletion of class schemas removes class-level permissions on MongoDB","details":"### Impact\n\nOn deployments that use MongoDB, a client without the master key can delete the stored schema of any class through the REST API. This removes the class's field definitions, class-level permissions and protected fields, including those set with the `protectedFields` server option. Data protected only by these can then become readable and modifiable by any client, and a class can become inaccessible to clients until it is re-created. Object ACLs continue to apply. Deployments that use PostgreSQL are not affected.\n\n### Patches\n\nClient requests to class names that are not valid class names, including the internal schema collection, are now rejected unless they use the master key or maintenance key.\n\n### Workarounds\n\nRegister a Cloud Code `beforeDelete` trigger for the class name `_SCHEMA` that rejects requests without the master key. Upgrading does not restore schemas that were already deleted; review the class-level permissions, protected fields and field definitions of all classes and restore them where needed.\n\n### References\n\n- GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-qmg9-m772-5rm7\n- Fix Parse Server 9: https://github.com/parse-community/parse-server/pull/10767\n- Fix Parse Server 8: https://github.com/parse-community/parse-server/pull/10768","categories":["Unclassified"],"product":"parse-server","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/parse-community/parse-server/security/advisories/GHSA-qmg9-m772-5rm7","source_modified_at":"2026-10-08T23:07:40Z","fetched_at":"2026-10-25T21:40:15.971031Z","package":{"ecosystem":"npm","name":"parse-server"},"range":">= 9.0.0, < 9.10.4-alpha.4"},{"source":"GitHub Advisory Database","source_url":"https://github.com/parse-community/parse-server/security/advisories/GHSA-qmg9-m772-5rm7","source_modified_at":"2026-10-08T23:07:40Z","fetched_at":"2026-10-25T21:40:15.971031Z","package":{"ecosystem":"npm","name":"parse-server"},"range":"< 8.6.101"}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/parse-community/parse-server/security/advisories/GHSA-qmg9-m772-5rm7","source_modified_at":"2026-10-08T23:07:40Z","fetched_at":"2026-10-25T21:40:15.971031Z","package":{"ecosystem":"npm","name":"parse-server"},"version":"9.10.4-alpha.4"},{"source":"GitHub Advisory Database","source_url":"https://github.com/parse-community/parse-server/security/advisories/GHSA-qmg9-m772-5rm7","source_modified_at":"2026-10-08T23:07:40Z","fetched_at":"2026-10-25T21:40:15.971031Z","package":{"ecosystem":"npm","name":"parse-server"},"version":"8.6.101"}],"cvss":8.8,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-08T23:07:40Z","modified_at":"2026-10-08T23:07:40Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/parse-community/parse-server/security/advisories/GHSA-qmg9-m772-5rm7","fetched_at":"2026-10-25T21:40:15.971031Z","source_modified_at":"2026-10-08T23:07:40Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-08T23:07:40Z","content_hash":"3e30854b8a1eedd9a731c111d3c21cb846e96423ef59c27a3f55eceaee90635b"}}