VULNERABILITY INTELLIGENCE
CVE-2026-116162
EPSS probability0.38%
CISA KEVNot currently listed
Published2026-10-25
Last modified2026-10-29
Description
Parse Server before 8.6.104 and 9.0.0 before 9.10.5-alpha.5 saves the entire login request with master privileges when issuing an SMS multi-factor authentication verification code. An SMS MFA-enrolled user can include extra fields in that request to modify master-key-restricted fields on their own account, such as the email-verification flag or beforeSave-protected values.
Weakness classification
- disclosure@vulncheck.com: CWE-269