CVE-2026-116162
Received Received - Intake

Parse Server SMS MFA Privilege Escalation Vulnerability

Publication date: 2026-10-25

Last updated on: 2026-10-25

Assigner: VulnCheck

Description
Parse Server before 8.6.104 and 9.0.0 before 9.10.5-alpha.5 saves the entire login request with master privileges when issuing an SMS multi-factor authentication verification code. An SMS MFA-enrolled user can include extra fields in that request to modify master-key-restricted fields on their own account, such as the email-verification flag or beforeSave-protected values.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-25
Last Modified
2026-10-25
Generated
2026-10-25
AI Q&A
2026-10-25
EPSS Evaluated
N/A
NVD
CVE-2026-116162
EUVD
EUVD-2026-109423

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
parse-community parse-server 9.0.0
parse-community parse-server 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Parse Server versions before 8.6.104 and 9.0.0 before 9.10.5-alpha.5. When a user with SMS-based multi-factor authentication (MFA) requests a login verification code, the server incorrectly saves the entire login request with master privileges. This allows the user to include extra fields in the request to modify restricted account fields on their own account, such as email-verification flags or protected values.

Detection Guidance

Check Parse Server version with: npm list parse-server. If using versions 9.0.0 to 9.10.5-alpha.4 or 8.6.103 or earlier, the system is vulnerable. Review SMS MFA login requests for unexpected field modifications in user accounts.

Impact Analysis

An SMS MFA-enrolled user could exploit this to modify their own account fields that are normally restricted, such as changing email verification status or bypassing beforeSave protections. This only affects the user's own account and does not allow modifying other users' data. Exploitation requires being enrolled in SMS MFA.

Mitigation Strategies

Upgrade Parse Server to version 9.10.5-alpha.5 or later, or 8.6.104 or later. Disable SMS MFA temporarily if immediate upgrade is not possible. Monitor user accounts for unauthorized field changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116162. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart