CVE-2026-116165 Parse Server 9.0.0 before 9.10.4-alpha.4 Unauthenticated Class Schema Deletion on MongoDB
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-116165?
CVE-2026-116165 is a high-severity vulnerability in parse-community parse-server, published on 25 Oct 2026.
Official description
Parse Server before 8.6.101 and 9.0.0 before 9.10.4-alpha.4 contains a missing authorization vulnerability on MongoDB deployments that lets clients without the master key delete the stored schema of any class. Unauthenticated attackers can send REST API delete requests targeting the internal _SCHEMA collection to remove field definitions, class-level permissions, and protected fields, exposing data to unauthorized reads and modifications.
Weakness: CWE-862
Which versions are affected by CVE-2026-116165?
How do I fix CVE-2026-116165?
No fix has been published for CVE-2026-116165 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-116165 being exploited?
There is no known exploitation of CVE-2026-116165 in the wild and no public exploit code.
Sources
Also known as GHSA-qj5q-p3h8-4r25, GHSA-qmg9-m772-5rm7.