CVE-2026-66009 PUBLISHED

Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages

Assigner: VulnCheck
Reserved: 23.07.2026 Published: 24.07.2026 Updated: 24.07.2026

Parse Server versions >= 9.0.0 before 9.10.0-alpha.5 and >= 8.2.2 before 8.6.86 return GraphQL validation error messages that name required custom input fields even when public introspection is disabled (graphQLPublicIntrospection: false, the default). A client holding only the public application id — with no user session, master key, or maintenance key — can trigger validation errors to learn the names of required (non-null) custom fields on classes it already references by name, partially defeating the schema-hiding intent of disabling public introspection. No stored data, credentials, optional field names, unreferenced class names, or Cloud Code function names are exposed.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS Score: 6.3

Product Status

Vendor parse-community
Product parse-server
Versions Default: unaffected
  • affected from 9.0.0 to 9.10.0-alpha.5 (excl.)
  • Version 9.10.0-alpha.5 is unaffected
Vendor parse-community
Product parse-server
Versions Default: unaffected
  • affected from 8.2.2 to 8.6.86 (excl.)
  • Version 8.6.86 is unaffected

Credits

  • mtrezza coordinator

References

Problem Types

  • Generation of Error Message Containing Sensitive Information CWE