CVE-2026-116165

Parse Server 9.0.0 before 9.10.4-alpha.4 Unauthenticated Class Schema Deletion on MongoDB

Published Oct 25, 2026 CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Description

Parse Server before 8.6.101 and 9.0.0 before 9.10.4-alpha.4 contains a missing authorization vulnerability on MongoDB deployments that lets clients without the master key delete the stored schema of any class. Unauthenticated attackers can send REST API delete requests targeting the internal _SCHEMA collection to remove field definitions, class-level permissions, and protected fields, exposing data to unauthorized reads and modifications.

Analysis

Technical impact

Parse Server versions prior to 8.6.101 and 9.0.0 before 9.10.4-alpha.4 contain a missing authorization flaw that permits clients lacking a master key to delete the _SCHEMA collection via a REST API delete request. The removal of field definitions, class‑level permissions, and protected fields effectively removes critical data safeguards, allowing unauthorized reads and modifications of stored data.

Affected Systems

All deployments of parse-server, maintained by parse-community, running a version earlier than 8.6.101 for the 8.x line or earlier than 9.10.4-alpha.4 for the 9.x line are susceptible. These affected systems expose the underlying MongoDB instance to unauthenticated write operations against the internal _SCHEMA collection.

Risk and Exploitability

The vulnerability carries a CVSS score of 8.8, indicating high severity. Exploitability is straightforward; an attacker can send a DELETE request to the REST API targeting the _SCHEMA collection without needing prior authentication. EPSS data is not available, and the issue is not listed in the CISA KEV catalog, but the lack of authorization enforcement makes it a readily exploitable risk for any exposed API endpoint.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

parse-community

parse-server

unaffected

Version	Status	Constraints
`9.0.0`	affected	< 9.10.4-alpha.4
`9.10.4-alpha.4`	unaffected	—

parse-community

parse-server

unaffected

Version	Status	Constraints
`0`	affected	< 8.6.101
`8.6.101`	unaffected	—

No data.

Vendor Product Versions

Parse Community

Parse Server

Version	Status	Scheme	Platform
`[9.0.0,9.10.4-alpha.4)`	affected	semver	—
`9.10.4-alpha.4`	unaffected	semver	—

Parse Community

Parse Server

Version	Status	Scheme	Platform
`[0,8.6.101)`	affected	semver	—
`8.6.101`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Parse Server to version 9.10.4‑alpha.4 or later to eliminate the missing authorization flaw.
Enforce MongoDB access restrictions by requiring authenticated requests or limiting delete permissions on the _SCHEMA collection.
Audit and harden class‑level permissions and protected field settings to ensure that only authorized actors can alter schema definitions.

Generated by OpenCVE AI on October 25, 2026 at 17:03 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.317% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/parse-community/parse-server/security/advisories/GHSA-qmg9-m772-5rm7
https://www.vulncheck.com/advisories/parse-server-9.0.0-before-9.10.4-alpha.4-unauthenticated-class-schema-deletion-on-mongodb

History

Oct 29, 2026 9:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Oct 25, 2026 8:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Parse Community Parse Community parse Server
Vendors & Products		Parse Community Parse Community parse Server

Oct 25, 2026 1:45 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Parse Server before 8.6.101 and 9.0.0 before 9.10.4-alpha.4 contains a missing authorization vulnerability on MongoDB deployments that lets clients without the master key delete the stored schema of any class. Unauthenticated attackers can send REST API delete requests targeting the internal _SCHEMA collection to remove field definitions, class-level permissions, and protected fields, exposing data to unauthorized reads and modifications.
Title		Parse Server 9.0.0 before 9.10.4-alpha.4 Unauthenticated Class Schema Deletion on MongoDB
First Time appeared		Parseplatform Parseplatform parse-server
Weaknesses		CWE-862
CPEs		cpe:2.3:a:parseplatform:parse-server::::::::
Vendors & Products		Parseplatform Parseplatform parse-server
References		https://github.com/parse-community/parse-server/security/advisories/GHSA-qmg9-m772-5rm7 https://www.vulncheck.com/advisories/parse-server-9.0.0-before-9.10.4-alpha.4-unauthenticated-class-schema-deletion-on-mongodb
Metrics		cvssV4_0 `{'score': 8.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N'}`