CVE-2026-116162

Published: Ott 25, 2026 Last Modified: Ott 25, 2026
ExploitDB:
Other exploit source:
Google Dorks:
LOW 2,1
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: high
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A

Description

Parse Server before 8.6.104 and 9.0.0 before 9.10.5-alpha.5 saves the entire login request with master privileges when issuing an SMS multi-factor authentication verification code. An SMS MFA-enrolled user can include extra fields in that request to modify master-key-restricted fields on their own account, such as the email-verification flag or beforeSave-protected values.

269

Improper Privilege Management

Draft
Abstraction: Class Structure: Simple
Common Consequences
Security Scopes Affected:
Access Control
Potential Impacts:
Gain Privileges Or Assume Identity
Applicable Platforms
All platforms may be affected
Likelihood of Exploit: Medium
View CWE Details
https://github.com/parse-community/parse-server/security/ad…
https://github.com/parse-community/parse-server/security/advisories/GHSA-9rh6-r…
https://www.vulncheck.com/advisories/parse-server-9.0.0-bef…
https://www.vulncheck.com/advisories/parse-server-9.0.0-before-9.10.5-alpha.5-p…