CVE-2026-116165
HIGH
MEDIUM
Priority: 0.03
BB Relevance:
78/100
Published: 2026-10-25
Modified: 2026-10-29
First seen: 2026-10-29
Status: active
Attack Surface
Network
Low Complexity
No Auth
No Interaction
Integ. Impact
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
None
UI:
None
S:
X
AT:
None
VC:
Low
VI:
High
VA:
Low
Description
Parse Server before 8.6.101 and 9.0.0 before 9.10.4-alpha.4 contains a missing authorization vulnerability on MongoDB deployments that lets clients without the master key delete the stored schema of any class. Unauthenticated attackers can send REST API delete requests targeting the internal _SCHEMA collection to remove field definitions, class-level permissions, and protected fields, exposing data to unauthorized reads and modifications.
Weakness Classification (1)
Affected Software (2)
| Vendor | Product | Version |
|---|---|---|
| parse-community | parse-server | 9.0.0 < 9.10.4-alpha.4 |
| parse-community | parse-server | 0 < 8.6.101 |