All vulnerabilities
CVE-2026-116162GHSA-9rh6-r4ph-367v

parse-server: Parse Server 9.0.0 before 9.10.5-alpha.5 Privilege Escalation via SMS MFA Login

parse-community parse-server
Open in ThreatlineRecord JSON
CVSS
2.1Low
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in9.10.5-alpha.5Also 8.6.104CVE List
Published25 Oct 2026Updated 25 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Parse Server before 8.6.104 and 9.0.0 before 9.10.5-alpha.5 saves the entire login request with master privileges when issuing an SMS multi-factor authentication verification code. An SMS MFA-enrolled user can include extra fields in that request to modify master-key-restricted fields on their own account, such as the email-verification flag or beforeSave-protected values.

Text from CVE List

Affected versions 4

  • parse-serveraffected: 9.0.0 before 9.10.5-alpha.5CVE List
  • parse-serverunaffected: 9.10.5-alpha.5CVE List
  • parse-serveraffected: all versions before 8.6.104CVE List
  • parse-serverunaffected: 8.6.104CVE List

References 2