Missing Authorization Vulnerability in Parse Server Affects MongoDB Deployments
CVE-2026-116165

8.8HIGH

Key Information:

Vendor

Parse-community

Status
Parse-server
Vendor
CVE Published:
25 October 2026

What is CVE-2026-116165?

A significant vulnerability exists in Parse Server versions prior to 8.6.101 and in versions 9.0.0 before 9.10.4-alpha.4 that allows attackers lacking the master key to delete critical schema information within MongoDB deployments. This weakness permits unauthenticated clients to send malicious REST API delete requests directed at the internal _SCHEMA collection, leading to the removal of field definitions, class-level permissions, and other protected fields. Consequently, this flaw increases the risk of unauthorized data exposure and manipulation.

Affected Version(s)

parse-server 9.0.0 < 9.10.4-alpha.4

parse-server 0 < 8.6.101

parse-server 9.10.4-alpha.4

References

https://github.com/parse-community/parse-server/security/...
vendor-advisory
https://www.vulncheck.com/advisories/parse-server-9.0.0-b...
third-party-advisory

CVSS V4

Score:
8.8
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

AdrianCurtin
mtrezza
.