Parse Server: Missing authorization allows deletion of class schemas
Summary
Parse Server before 8.6.101 and 9.0.0 before 9.10.4-alpha.4 does not check authorization when clients without the master key send REST API delete requests to the internal _SCHEMA collection. This only applies to deployments that use MongoDB; PostgreSQL is not affected. An unauthenticated attacker over the network can delete class schemas, which removes field definitions, class-level permissions and protected fields, so data can become readable or modifiable by any client, and a class can become inaccessible until it is re-created.
Affected
- parse-server 9.0.0 up to but not including 9.10.4-alpha.4
- parse-server before 8.6.101
- Only deployments using MongoDB
Fixed in
- 8.6.101
- 9.10.4-alpha.4
- For the 9.x line, stable 9.10.4 is the recommended target (the advisory and OSV list 9.10.4)
Workaround
- Vendor advisory: register a Cloud Code beforeDelete trigger for the class name _SCHEMA that rejects requests without the master key
- Upgrading does not restore schemas that were already deleted
- Vendor-documented workaround is limited to the trigger above; treat other mitigations as unverified
Exploitation
- No confirmed exploitation in the wild; one tracker reports KEV status as "No" (CISA KEV catalog not checked directly)
- CISA SSVC: exploitation none, automatable no, technical impact partial
- No public proof of concept found; the public fix commit and pull request may help attackers reverse-engineer the flaw
Our recommendation
- Upgrade to 8.6.101 or 9.10.4 (or 9.10.4-alpha.4) without delay
- Check whether Parse Server is present, including transitive Node.js dependencies, and whether it is reachable from the internet
- Confirm the master key is set and kept secret
- Review the _SCHEMA collection in MongoDB for missing or altered class-level permissions, protected fields and field definitions, and restore them where needed
- Check backups before upgrading and monitor API logs for unexpected DELETE requests
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-qmg9-m772-5rm7 github.com
- VulnCheck advisory for CVE-2026-116165 www.vulncheck.com
- Fix pull request #10768 (Parse Server 8) github.com
- Parse Server release 8.6.101 github.com
- Parse Server release 9.10.4-alpha.4 github.com
- Parse Server release 9.10.4 github.com
- OSV entry BIT-parse-2026-116165 osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 10:36.
Original description (NVD)
Parse Server before 8.6.101 and 9.0.0 before 9.10.4-alpha.4 contains a missing authorization vulnerability on MongoDB deployments that lets clients without the master key delete the stored schema of any class. Unauthenticated attackers can send REST API delete requests targeting the internal _SCHEMA collection to remove field definitions, class-level permissions, and protected fields, exposing data to unauthorized reads and modifications.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.