CVE-2026-116162 Parse Server 9.0.0 before 9.10.5-alpha.5 Privilege Escalation via SMS MFA Login
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-116162?
CVE-2026-116162 is a low-severity vulnerability in parse-community parse-server, published on 25 Oct 2026.
Official description
Parse Server before 8.6.104 and 9.0.0 before 9.10.5-alpha.5 saves the entire login request with master privileges when issuing an SMS multi-factor authentication verification code. An SMS MFA-enrolled user can include extra fields in that request to modify master-key-restricted fields on their own account, such as the email-verification flag or beforeSave-protected values.
Weakness: CWE-269
Which versions are affected by CVE-2026-116162?
How do I fix CVE-2026-116162?
No fix has been published for CVE-2026-116162 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-116162 being exploited?
There is no known exploitation of CVE-2026-116162 in the wild and no public exploit code.
Sources
Also known as GHSA-9rh6-r4ph-367v, GHSA-x857-q7x6-j662.