The vulnerability arises from the GraphQL implementation in Parse Server, where inline fragments containing __type queries bypass the public introspection guard when graphQLPublicIntrospection is disabled. This allows unauthenticated users to determine the names of types, such as "User", which is a form of information disclosure. The flaw maps to the CWE-863 weakness of failing to enforce accurate authorization checks for type introspection under controlled circumstances.

The affected product is the Parse Server open‑source backend. Versions from 9.3.1‑alpha.3 up to, but not including, 9.5.0‑alpha.10 are vulnerable. All instances hosted on any Node.js‑capable infrastructure that have the mentioned range of Parse Server releases should be inspected.

The CVSS score is 6.9, indicating moderate severity, and the EPSS score is less than 1 %, implying a low likelihood of exploitation at the time of assessment. The issue is not listed in CISA’s KEV catalog. Exploitation requires a client with network access to the exposed GraphQL endpoint and the knowledge that public introspection has been disabled; an attacker can simply send crafted inline‑fragment queries to discover type names.