CVE-2026-116165
Parse Server before 8.6.101 and 9.0.0 before 9.10.4-alpha.4 contains a missing authorization…
- Risk score
- 58/100
- CVSS
- 8.8 v4.0
- Published
- 25 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Parse Server before 8.6.101 and 9.0.0 before 9.10.4-alpha.4 contains a missing authorization vulnerability on MongoDB deployments that lets clients without the master key delete the stored schema of any class. Unauthenticated attackers can send REST API delete requests targeting the internal _SCHEMA collection to remo…
- Affected
- See advisory
- Fix
- Upgrade the product to 8.6.101, 9.0.0 or 9.10.4 (whichever matches your release line), or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 8.8 high
- Remotely exploitable without logging in
References
Original description
Parse Server before 8.6.101 and 9.0.0 before 9.10.4-alpha.4 contains a missing authorization vulnerability on MongoDB deployments that lets clients without the master key delete the stored schema of any class. Unauthenticated attackers can send REST API delete requests targeting the internal _SCHEMA collection to remove field definitions, class-level permissions, and protected fields, exposing data to unauthorized reads and modifications.
Last activity 25 Oct 2026. Patch Forecast updates every hour.