Skip to content
CVE PROGRAM SOURCE RECORD2.1 Low

CVE-2026-116162

Parse Server 9.0.0 before 9.10.5-alpha.5 Privilege Escalation via SMS MFA Login

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

Parse Server before 8.6.104 and 9.0.0 before 9.10.5-alpha.5 saves the entire login request with master privileges when issuing an SMS multi-factor authentication verification code. An SMS MFA-enrolled user can include extra fields in that request to modify master-key-restricted fields on their own account, such as the email-verification flag or beforeSave-protected values.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

parse-community parse-server

Default version status: unaffected

  • 9.0.0 to < 9.10.5-alpha.5affected
  • 9.10.5-alpha.5unaffected
pkg:npm/parse-server

parse-community parse-server

Default version status: unaffected

  • 0 to < 8.6.104affected
  • 8.6.104unaffected
pkg:npm/parse-server

References