CVE-2026-116165
Received Received - Intake

Parse Server MongoDB Schema Deletion Flaw

Publication date: 2026-10-25

Last updated on: 2026-10-25

Assigner: VulnCheck

Description
Parse Server before 8.6.101 and 9.0.0 before 9.10.4-alpha.4 contains a missing authorization vulnerability on MongoDB deployments that lets clients without the master key delete the stored schema of any class. Unauthenticated attackers can send REST API delete requests targeting the internal _SCHEMA collection to remove field definitions, class-level permissions, and protected fields, exposing data to unauthorized reads and modifications.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-25
Last Modified
2026-10-25
Generated
2026-10-25
AI Q&A
2026-10-25
EPSS Evaluated
N/A
NVD
CVE-2026-116165
EUVD
EUVD-2026-109426

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
parse-community parse-server 9.0.0
parse-community parse-server 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-116165 is a missing authorization vulnerability in Parse Server versions before 8.6.101 and 9.0.0 before 9.10.4-alpha.4 when using MongoDB. It allows unauthenticated attackers to send REST API delete requests targeting the internal _SCHEMA collection, deleting field definitions, class-level permissions, and protected fields. This exposes data to unauthorized access and modifications.

Detection Guidance

Check Parse Server logs for unauthorized REST API delete requests targeting the _SCHEMA collection. Monitor network traffic for DELETE requests to /classes/_SCHEMA without authentication. Verify MongoDB audit logs for suspicious deletions of the _SCHEMA collection.

Impact Analysis

This vulnerability allows attackers to delete class schemas, removing field definitions and permissions. This can expose sensitive data to unauthorized access or modification. Object ACLs remain intact, but manual restoration of schemas and permission reviews are required. PostgreSQL deployments are unaffected.

Mitigation Strategies
  • Upgrade Parse Server to versions 9.10.4-alpha.4 or 8.6.101 or later to patch the vulnerability.
  • Implement a Cloud Code beforeDelete trigger for the _SCHEMA class to block unauthorized deletions.
  • Review and restore any deleted schemas from backups if the vulnerability was exploited.
  • Audit class-level permissions and protected fields after mitigation to ensure no unauthorized changes occurred.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116165. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart