Parse Server versions before 8.6.101 and from 9.0.0 up to but not including 9.10.4 have a missing authorization vulnerability affecting MongoDB deployments. This flaw allows unauthenticated attackers to delete the stored schema of any class by sending REST API delete requests to the internal _SCHEMA collection. Such unauthorized deletions can remove field definitions, class-level permissions, and protected fields, potentially exposing data to unauthorized reads and modifications. The issue is fixed in versions 8.6.101 and 9.10.4.