---
cve: "CVE-2026-116165"
severity: "HIGH"
cvss: 8.8
epss: "0.3%"
vendor: "parse-community"
kev: false
exploited: false
published: "2026-10-25 14:16:55"
tags: [cve, security, high]
source: tsecurity.de CVE-Dossier
exported: "2026-10-29T10:42:05+01:00"
---

# CVE-2026-116165

> 8.8 HIGH · 🧪 PoC

## Beschreibung

Parse Server before 8.6.101 and 9.0.0 before 9.10.4-alpha.4 contains a missing authorization vulnerability on MongoDB deployments that lets clients without the master key delete the stored schema of any class. Unauthenticated attackers can send REST API delete requests targeting the internal _SCHEMA collection to remove field definitions, class-level permissions, and protected fields, exposing data to unauthorized reads and modifications.

## CNA-Record (Kanon, cvelistV5)

- CNA: **VulnCheck**
- State: PUBLISHED
- Stand: 2026-10-25 13:20:09
- CNA-CVSS: **8.8** (`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N`)

## CVSS-Vektor

```
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |
| UI Interaktion | Keine | bad |

## Schwachstellen-Klasse

- **CWE-862** — Missing Authorization
  The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

## Angriffsmuster (CAPEC)

- [CAPEC-665 — Exploitation of Thunderbolt Protection Flaws](https://capec.mitre.org/data/definitions/665.html) _(Severity: Very High)_

## ATT&CK-Techniken

- [T1211 — Exploitation for Defensive Evasion](https://attack.mitre.org/techniques/T1211/)
- [T1542.002 — Pre-OS Boot: Component Firmware](https://attack.mitre.org/techniques/T1542/002/)
- [T1556 — Modify Authentication Process](https://attack.mitre.org/techniques/T1556/)

## Patch verfügbar (OSV)

- ffc453e85a305facab9468cb6ec36d1d921551ee
- ff10828f1da84aba5e0d7e26c16ffccf5b1d4df9

## Referenzen

- <https://github.com/parse-community/parse-server/security/advisories/GHSA-qmg9-m772-5rm7>
- <https://www.vulncheck.com/advisories/parse-server-9.0.0-before-9.10.4-alpha.4-unauthenticated-class-schema-deletion-on-mongodb>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2026-116165/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_