Privilege Escalation Vulnerability in Parse Server by Parse Community
CVE-2026-116162

2.1LOW

Key Information:

Vendor

Parse-community

Status
Parse-server
Vendor
CVE Published:
25 October 2026

What is CVE-2026-116162?

Parse Server prior to version 8.6.104 and 9.0.0 versions leading up to 9.10.5-alpha.5 contains a significant vulnerability that allows users enrolled in SMS multi-factor authentication (MFA) to manipulate master-key-restricted fields during the login request. This could potentially enable unauthorized changes to sensitive account parameters, such as the email-verification flag or beforeSave-protected values. The exploitation of this flaw poses a severe risk to user account integrity, facilitating the elevation of privileges and unauthorized access.

Affected Version(s)

parse-server 9.0.0 < 9.10.5-alpha.5

parse-server 0 < 8.6.104

parse-server 9.10.5-alpha.5

References

https://github.com/parse-community/parse-server/security/...
vendor-advisory
https://www.vulncheck.com/advisories/parse-server-9.0.0-b...
third-party-advisory

CVSS V4

Score:
2.1
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

mtrezza
.