PT-2026-123006

CVE-2026-116165

Published

2026-10-25

Updated

2026-10-30

Description by

CVSS 4.0

8.8

High

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.101 Parse Server versions 9.0.0 through 9.10.4-alpha.3

Description On MongoDB deployments, a missing authorization issue allows clients without the master key to delete the stored schema of any class. Unauthenticated attackers can send REST API delete requests targeting the internal SCHEMA collection to remove field definitions, class-level permissions, and protected fields, which exposes data to unauthorized reads and modifications.

Recommendations Update to version 8.6.101 or later. Update to version 9.10.4-alpha.4 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Adriancurtin

Mtrezza

Vendors

Affected products

Weakness enumeration

CWE-862: Missing Authorization