All vulnerabilities
CVE-2026-116165GHSA-qmg9-m772-5rm7

parse-server: Parse Server 9.0.0 before 9.10.4-alpha.4 Unauthenticated Class Schema Deletion on MongoDB

parse-community parse-server
Open in ThreatlineRecord JSON
CVSS
8.8High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in9.10.4-alpha.4Also 8.6.101CVE List
Published25 Oct 2026Updated 25 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Parse Server before 8.6.101 and 9.0.0 before 9.10.4-alpha.4 contains a missing authorization vulnerability on MongoDB deployments that lets clients without the master key delete the stored schema of any class. Unauthenticated attackers can send REST API delete requests targeting the internal _SCHEMA collection to remove field definitions, class-level permissions, and protected fields, exposing data to unauthorized reads and modifications.

Text from CVE List

Affected versions 4

  • parse-serveraffected: 9.0.0 before 9.10.4-alpha.4CVE List
  • parse-serverunaffected: 9.10.4-alpha.4CVE List
  • parse-serveraffected: all versions before 8.6.101CVE List
  • parse-serverunaffected: 8.6.101CVE List

References 2