CVE-2026-116165

— UNSCOREDpublic exploit available

Published 2026-10-25 · Updated 2026-10-26

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

Parse Server before 8.6.101 and 9.0.0 before 9.10.4-alpha.4 contains a missing authorization vulnerability on MongoDB deployments that lets clients without the master key delete the stored schema of any class. Unauthenticated attackers can send REST API delete requests targeting the internal _SCHEMA collection to remove field definitions, class-level permissions, and protected fields, exposing data to unauthorized reads and modifications.

Weaknesses

CWE-862

Public exploit & PoC references

https://github.com/parse-community/parse-server/security/advisories/GHSA-qmg9-m772-5rm7

All references

https://github.com/parse-community/parse-server/security/advisories/GHSA-qmg9-m772-5rm7
https://www.vulncheck.com/advisories/parse-server-9.0.0-before-9.10.4-alpha.4-unauthenticated-class-schema-deletion-on-mongodb

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

MEDIUMCVE-2025-14484
MEDIUMCVE-2025-14486
MEDIUMCVE-2025-14487
MEDIUMCVE-2025-7043
HIGHCVE-2025-71433PoC
MEDIUMCVE-2026-0198
HIGHCVE-2026-100217
CRITICALCVE-2026-100240

Related by shared AI tags and CWE weakness class. Browse the full archive.