CVE-2026-116162 in Parse Server
Summary
by MITRE • 10/25/2026
Parse Server before 8.6.104 and 9.0.0 before 9.10.5-alpha.5 saves the entire login request with master privileges when issuing an SMS multi-factor authentication verification code. An SMS MFA-enrolled user can include extra fields in that request to modify master-key-restricted fields on their own account, such as the email-verification flag or beforeSave-protected values.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/25/2026
The vulnerability identified involves a critical authorization bypass within Parse Server versions prior to 8.6.104 and 9.0.0 prior to 9.10.5-alpha.5, specifically affecting the SMS multi-factor authentication verification code issuance process. The core technical flaw stems from an improper handling of request context during the MFA workflow. When a user enrolled in SMS-based two-factor authentication initiates a login or verification sequence, the server processes this request with elevated master privileges to ensure that sensitive security operations can proceed without standard access control restrictions interfering with the authentication flow. However, the implementation fails to sanitize or restrict the input fields included in this privileged request context. Consequently, any additional parameters sent by the client alongside the SMS verification code are processed under the same high-privilege scope as the MFA logic itself.
This architectural oversight allows an authenticated user who has enrolled their phone number for multi-factor authentication to manipulate master-key-restricted attributes on their own account profile. By injecting extra fields into the HTTP request used to trigger the SMS delivery, the attacker can overwrite or modify protected data structures that are normally immutable by standard users. Specific examples of affected fields include the email-verification flag and values guarded by beforeSave cloud code hooks. The ability to alter these attributes effectively circumvents both native access control mechanisms and custom server-side validation logic designed to maintain data integrity and security posture.
From an operational impact perspective, this vulnerability enables a significant escalation of privileges for any user with SMS MFA enabled. An attacker can mark their email address as verified without completing the standard verification process, potentially bypassing identity confirmation requirements in applications that rely on this flag for trust levels or feature access. Furthermore, modifying beforeSave-protected values allows the circumvention of business logic rules and data validation constraints enforced by server-side scripts. This could lead to unauthorized changes in user roles, account statuses, or other sensitive metadata, undermining the integrity of the application's security model and potentially facilitating further attacks such as account takeover or privilege escalation within dependent systems.
The vulnerability aligns with CWE-269, which describes Improper Privilege Control, where a process is granted more privileges than necessary for its function. It also maps to MITRE ATT&CK technique T1078, Valid Accounts, specifically in the context of using legitimate credentials and enrolled MFA methods to perform unauthorized actions that bypass intended access controls. The flaw represents a failure in input validation within an elevated execution context, highlighting the risks associated with reusing master-key contexts for user-initiated operations without strict parameter filtering.
Mitigation strategies require immediate upgrading to Parse Server version 8.6.104 or later, or version 9.10.5-alpha.5 and subsequent stable releases where this issue has been addressed. For organizations unable to upgrade immediately, a temporary workaround involves disabling SMS multi-factor authentication for affected instances until the patch is applied. Additionally, developers should review any custom beforeSave hooks to ensure they perform independent validation of input data regardless of the request context, although relying solely on application-layer checks without fixing the underlying framework vulnerability is not recommended as it may be bypassed by other similar flaws in privileged contexts.