CVE-2026-116162

Parse Server 9.0.0 before 9.10.5-alpha.5 Privilege Escalation via SMS MFA Login

Published Oct 25, 2026 CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed

Description

Parse Server before 8.6.104 and 9.0.0 before 9.10.5-alpha.5 saves the entire login request with master privileges when issuing an SMS multi-factor authentication verification code. An SMS MFA-enrolled user can include extra fields in that request to modify master-key-restricted fields on their own account, such as the email-verification flag or beforeSave-protected values.

Analysis

Technical impact

Parse Server versions before 8.6.104 and 9.0.0 before 9.10.5‑alpha.5 record the entire login request with master privileges when an SMS multi‑factor authentication verification code is requested. An SMS MFA‑enrolled user can add arbitrary fields to that request and modify master‑key‑restricted attributes on their own account, such as the email‑verification flag or beforeSave‑protected values, thereby escalating privileges. This flaw is a CWE‑269 instance of Privilege Escalation Through Abuse of Trusted Component.

Affected Systems

The vulnerability affects products from parse-community: parse-server, specifically parse-server releases earlier than 8.6.104 and 9.0.0 earlier than 9.10.5‑alpha.5. Any installation of these versions that uses SMS MFA for authentication is susceptible.

Risk and Exploitability

The CVSS score is 2.1, indicating a very low overall risk. EPSS is not available, and the flaw is not listed in CISA’s KEV catalog. The attack requires an account that has SMS MFA enabled and the ability to submit a login request; no elevated network or code‑execution privileges are needed. While the impact is a privilege escalation within the account, the likelihood of exploitation is limited by the narrow attack vector and the low severity score. Still, patching should be prioritized to eliminate the flaw completely.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

parse-community

parse-server

unaffected

Version	Status	Constraints
`9.0.0`	affected	< 9.10.5-alpha.5
`9.10.5-alpha.5`	unaffected	—

parse-community

parse-server

unaffected

Version	Status	Constraints
`0`	affected	< 8.6.104
`8.6.104`	unaffected	—

No data.

Vendor Product Versions

Parse Community

Parse Server

Version	Status	Scheme	Platform
`[9.0.0,9.10.5-alpha.5)`	affected	semver	—
`9.10.5-alpha.5`	unaffected	semver	—

Parse Community

Parse Server

Version	Status	Scheme	Platform
`[0,8.6.104)`	affected	semver	—
`8.6.104`	unaffected	semver	—

Parseplatform

Parse-server

Version	Status	Scheme	Platform
`[0,*]`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Parse Server to version 9.10.5‑alpha.5 or later to remove the master‑privilege elevation bug
Configure the MFA login handling to accept only whitelisted fields, rejecting any attempt to alter master‑key‑restricted attributes
Disable or tightly control the use of master keys in login requests, ensuring that no request can automatically inherit master privileges

Generated by OpenCVE AI on October 25, 2026 at 16:43 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required High

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.382% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/parse-community/parse-server/security/advisories/GHSA-9rh6-r4ph-367v
https://www.vulncheck.com/advisories/parse-server-9.0.0-before-9.10.5-alpha.5-privilege-escalation-via-sms-mfa-login

History

Oct 30, 2026 7:30 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Oct 25, 2026 8:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Parse Community Parse Community parse Server
Vendors & Products		Parse Community Parse Community parse Server

Oct 25, 2026 1:45 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Parse Server before 8.6.104 and 9.0.0 before 9.10.5-alpha.5 saves the entire login request with master privileges when issuing an SMS multi-factor authentication verification code. An SMS MFA-enrolled user can include extra fields in that request to modify master-key-restricted fields on their own account, such as the email-verification flag or beforeSave-protected values.
Title		Parse Server 9.0.0 before 9.10.5-alpha.5 Privilege Escalation via SMS MFA Login
First Time appeared		Parseplatform Parseplatform parse-server
Weaknesses		CWE-269
CPEs		cpe:2.3:a:parseplatform:parse-server::::::::
Vendors & Products		Parseplatform Parseplatform parse-server
References		https://github.com/parse-community/parse-server/security/advisories/GHSA-9rh6-r4ph-367v https://www.vulncheck.com/advisories/parse-server-9.0.0-before-9.10.5-alpha.5-privilege-escalation-via-sms-mfa-login
Metrics		cvssV4_0 `{'score': 2.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N'}`