CVE-2026-116165: Parse Server schema deletion without authorization

CVE-2026-116165 is a missing authorization vulnerability in Parse Server versions before 8.6.101 and 9.0.0 before 9.10.4-alpha.4 on MongoDB deployments. The flaw allows unauthenticated clients to send REST API DELETE requests targeting the internal _SCHEMA collection, removing field definitions, class-level permissions, and protected fields. The impact is exposure of data to unauthorized reads and modifications.

The vulnerability has been rated CVSS 8.8 (High). No confirmed public exploit exists in available data, but on October 30, 2026, GitHub reported an offline detector for identifying vulnerable Parse Server instances and MongoDB backend inventory. The flaw was disclosed publicly on October 25, 2026 via NVD. The nature of this vulnerability—unauthenticated access to schema deletion operations—indicates immediate operational risk for organizations running Parse Server in production.

IT teams and system administrators must upgrade Parse Server to version 8.6.101 or later for the 8.x branch, or to 9.10.4-alpha.4 or later for the 9.x branch. Before patching, inventory all Parse Server deployments running on MongoDB. Do not download exploits from public repositories; official vendor patches are the verified path to mitigation. Monitor REST API logs for DELETE attempts against _SCHEMA as an indicator of possible attack.