BIT-parse-2026-116162

See a problem?
Import Source
https://github.com/bitnami/vulndb/tree/main/data/parse/BIT-parse-2026-116162.json
JSON Data
https://api.osv.dev/v1/vulns/BIT-parse-2026-116162
Aliases
Published
2026-10-30T15:35:43Z
Modified
2026-10-30T20:56:14Z
Summary
Parse Server 9.0.0 before 9.10.5 Privilege Escalation via SMS MFA Login
Details

Parse Server before 8.6.104 and 9.0.0 before 9.10.5 saves the entire login request with master privileges when issuing an SMS multi-factor authentication verification code. An SMS MFA-enrolled user can include extra fields in that request to modify master-key-restricted fields on their own account, such as the email-verification flag or beforeSave-protected values.

Database specific 
{
    "cpes": [
        "cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*"
    ],
    "severity": "Low"
}
References

Affected packages

Bitnami / parse

Package

Name
parse
Purl
pkg:bitnami/parse

Severity

  • 2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
8.6.104
Introduced
9.0.0
Fixed
9.10.5

Database specific

source 
"https://github.com/bitnami/vulndb/tree/main/data/parse/BIT-parse-2026-116162.json"