CVE-2026-116162: Parse Server 9.0.0 before 9.10.5-alpha.5 Privilege Escalation via SMS MFA Login

Q: Which deployments are exposed?

Deployments running Parse Server before 8.6.104, or version 9.0.0 through versions before 9.10.5-alpha.5, are affected. Exploitation applies to accounts enrolled in SMS multi-factor authentication.

Q: What does an attacker need to exploit this issue?

The attacker needs to control an SMS MFA-enrolled user account and submit extra fields in the login request while requesting an SMS MFA verification code. The issue allows changes to that same account rather than arbitrary accounts described in the available data.

Q: What could an attacker change?

Extra request fields can modify fields normally restricted to the master key, including the email-verification flag and values protected by beforeSave logic. This can bypass application controls that rely on those restrictions for the affected user's account.

Published Oct 25, 2026

Updated

Parse Server before 8.6.104 and 9.0.0 before 9.10.5-alpha.5 saves the entire login request with master privileges when issuing an SMS multi-factor authentication verification code. An SMS MFA-enrolled user can include extra fields in that request to modify master-key-restricted fields on their own account, such as the email-verification flag or beforeSave-protected values.

Affected Software

1 affected component

Parse Parse Server<8.6.104, >=9.0.0<9.10.5-alpha.5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Parse Server to a version that resolves this vulnerability.
Fixed in 8.6.104
Upgrade
Upgrade Parse Server to a version that resolves this vulnerability.
Fixed in 9.10.5-alpha.5

Event History

Oct 25, 2026

CVE Published

via MITRE·01:20 PM

Data Sourced

via MITRE·01:20 PM

DescriptionWeakness

Frequently Asked Questions

Which deployments are exposed?

Deployments running Parse Server before 8.6.104, or version 9.0.0 through versions before 9.10.5-alpha.5, are affected. Exploitation applies to accounts enrolled in SMS multi-factor authentication.

What does an attacker need to exploit this issue?

The attacker needs to control an SMS MFA-enrolled user account and submit extra fields in the login request while requesting an SMS MFA verification code. The issue allows changes to that same account rather than arbitrary accounts described in the available data.

What could an attacker change?

Extra request fields can modify fields normally restricted to the master key, including the email-verification flag and values protected by beforeSave logic. This can bypass application controls that rely on those restrictions for the affected user's account.

CVE-2026-116162: Parse Server 9.0.0 before 9.10.5-alpha.5 Privilege Escalation via SMS MFA Login

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

What could an attacker change?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

What could an attacker change?