CVE-2026-116165

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.101 Parse Server versions 9.0.0 through 9.10.4-alpha.3

Description Missing authorization on MongoDB deployments allows clients without the master key to delete the stored schema of any class. Unauthenticated attackers can send REST API delete requests targeting the internal SCHEMA collection to remove field definitions, class-level permissions, and protected fields, which exposes data to unauthorized reads and modifications.

Recommendations Update Parse Server to version 8.6.101 or later. Update Parse Server to version 9.10.4-alpha.4 or later.