ETK-2026-1221Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-1221",
  "cve_id": null,
  "display_id": "ETK-2026-1221",
  "ghsa_id": "GHSA-qmg9-m772-5rm7",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "Improper authorization permits schema deletion in parse-server",
  "summary": "MongoDB-backed parse-server deployments can allow a REST client without the master key to delete class schema metadata. This may remove field and class access settings, potentially exposing or allowing changes to data that relied on those settings; object-level ACLs still apply. PostgreSQL-backed deployments are not affected.",
  "mitigation": "Upgrade parse-server to 8.6.101 or 9.10.4-alpha.4, as appropriate for the deployed release line. If an immediate upgrade is not possible, reject non-master-key deletes of the internal schema collection and audit and restore affected schema definitions and access settings.",
  "vendor": "npm",
  "product": "parse-server",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 9.0.0, < 9.10.4-alpha.4"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "9.10.4-alpha.4"
      ],
      "package_name": "parse-server",
      "purl": "pkg:npm/parse-server"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        "< 8.6.101"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "8.6.101"
      ],
      "package_name": "parse-server",
      "purl": "pkg:npm/parse-server"
    }
  ],
  "cwes": [
    862
  ],
  "cvss_score": 8.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 10.955704866666666,
  "t0_at": null,
  "signals": {
    "trigger_signal": {
      "at": "2026-10-08T23:07:40+00:00",
      "days": -12.238763533622684,
      "is_lower_bound": true,
      "measured_at": "2026-10-21T04:51:29.207777+00:00",
      "url": "https://github.com/parse-community/parse-server/security/advisories/GHSA-qmg9-m772-5rm7"
    }
  }
}