---
id: CVE-2026-116165
title: >-
  Parse Server 9.0.0 before 9.10.4-alpha.4 Unauthenticated Class Schema Deletion
  on MongoDB
summary: >-
  Parse Server before 8.6.101 and 9.0.0 before 9.10.4-alpha.4 contains a missing
  authorization vulnerability on MongoDB deployments that lets clients without
  the master key delete the stored schema of any class. Unauthenticated
  attackers c…
severity: high
cvss: 8.8
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-862
vendor: parse-community
product: parse-server
affected:
  - parse-server >= 9.0.0 < 9.10.4-alpha.4
  - parse-server < 8.6.101
published: '2026-10-25'
updated: '2026-10-25'
sourceUpdated: '2026-10-25T13:20:09.004Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-116165'
references:
  - url: >-
      https://github.com/parse-community/parse-server/security/advisories/GHSA-qmg9-m772-5rm7
    label: GitHub Security Advisory (GHSA-qmg9-m772-5rm7)
  - url: >-
      https://www.vulncheck.com/advisories/parse-server-9.0.0-before-9.10.4-alpha.4-unauthenticated-class-schema-deletion-on-mongodb
    label: >-
      VulnCheck Advisory: Parse Server 9.0.0 before 9.10.4-alpha.4
      Unauthenticated Class Schema Deletion on MongoDB
tags:
  - cve.org
ingestedAt: '2026-10-25T22:08:29.949Z'
---

## Overview

Parse Server before 8.6.101 and 9.0.0 before 9.10.4-alpha.4 contains a missing authorization vulnerability on MongoDB deployments that lets clients without the master key delete the stored schema of any class. Unauthenticated attackers can send REST API delete requests targeting the internal _SCHEMA collection to remove field definitions, class-level permissions, and protected fields, exposing data to unauthorized reads and modifications.

## Affected

- `parse-server >= 9.0.0 < 9.10.4-alpha.4`
- `parse-server < 8.6.101`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.