Vulnerability · Published Oct 25, 2026 · Assigned by VulnCheck

CVE-2026-116162Parse Server 9.0.0 before 9.10.5-alpha.5 Privilege Escalation via SMS MFA Login

Low 2.1

In plain English

A low-severity privilege mismanagement in parse-server from parse-community. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities).

Severity (CVSS 4.0)2.1Low

Exploit odds (30 days)0.4%top 67.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Parse Server before 8.6.104 and 9.0.0 before 9.10.5-alpha.5 saves the entire login request with master privileges when issuing an SMS multi-factor authentication verification code. An SMS MFA-enrolled user can include extra fields in that request to modify master-key-restricted fields on their own account, such as the email-verification flag or beforeSave-protected values.

Affected products (as reported)

Vendor	Product	Versions
parse-community	parse-server	9.0.0 – before 9.10.5-alpha.5
parse-community	parse-server	0 – before 8.6.104

Weakness: CWE-269 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

References

GitHub Security Advisory (GHSA-9rh6-r4ph-367v) vendor-advisory
VulnCheck Advisory: Parse Server 9.0.0 before 9.10.5-alpha.5 Privilege Escalation via SMS MFA Login third-party-advisory