Is CVE-2026-116165 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-116165 being exploited in the wild.

How severe is CVE-2026-116165?

Informational severity, published 25 October 2026.

Which products and versions are affected?

Parse Community Parse Server 8.6.100 and earlier; 9.0.0 to 9.10.4-alpha.3.

How is CVE-2026-116165 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-116165?

Check whether you run Parse Community Parse Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-116165: Parse Server missing authorization in MongoDB schema deletion

CVE-2026-116165 · Severity: info · Published 2026-10-25

Parse Server is a backend framework that manages data and access control for applications. An unauthenticated attacker can remotely delete class schemas in MongoDB deployments through the REST API, bypassing security restrictions. This removes field definitions and class-level permissions, allowing attackers to read and modify data that should be protected, or render a class inaccessible until it is recreated.

Technologies: Parse Community Parse Server. Vendors: Parse Community.

Quick answers

Is CVE-2026-116165 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-116165 being exploited in the wild.
How severe is CVE-2026-116165?: Informational severity, published 25 October 2026.
Which products and versions are affected?: Parse Community Parse Server 8.6.100 and earlier; 9.0.0 to 9.10.4-alpha.3.
Is there a fix for CVE-2026-116165?: Yes: fixed in Parse Server 8.6.101, 9.10.4-alpha.4. Until then: Register a Cloud Code beforeDelete trigger for the class name _SCHEMA that rejects requests without the master key. Note that upgrading does not restore schemas already deleted; review and restore class-level permissions, protected fields, and field definitions across all classes after patching.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-10-08"},{"kind":"advisory","at":"2026-10-25"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-116165 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-116165?: Check whether you run Parse Community Parse Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Parse Server 8.6.101, 9.10.4-alpha.4

Register a Cloud Code beforeDelete trigger for the class name _SCHEMA that rejects requests without the master key. Note that upgrading does not restore schemas already deleted; review and restore class-level permissions, protected fields, and field definitions across all classes after patching.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-10-08"},{"kind":"advisory","at":"2026-10-25"}]

Technical details

Missing authorization validation allows unauthenticated clients to send DELETE requests to the internal _SCHEMA collection via the REST API on MongoDB deployments. The vulnerability enables removal of class field definitions, class-level permissions, and protected field settings that normally restrict data access. The attack requires no authentication, network access, or user interaction; PostgreSQL deployments are unaffected.

Affected products

Parse Community Parse Server 8.6.100 and earlier; 9.0.0 to 9.10.4-alpha.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.