CVE-2026-116165

Parse Server versions before 8.6.101 and 9.0.0 before 9.10.4-alpha.4 are vulnerable to a missing authorization flaw on MongoDB deployments. This allows unauthenticated attackers to send REST API delete requests targeting the internal _SCHEMA collection. Successful exploitation enables the deletio...