Parse Server’s GraphQL endpoint previously returned "Did you mean …?" suggestions in validation error messages, revealing internal schema metadata such as class names, field names, and mutation names. An attacker who only knows the public application ID can send malformed queries and use these suggestions to reconstruct the entire schema. The result is a disclosure of sensitive structural information that can aid subsequent attacks. This flaw is categorized as a Sensitive Information Exposure (CWE‑209).

The vulnerability affects parse-community:parse-server deployments running any version older than 8.6.78 or 9.9.1‑alpha.2. The software can be hosted on any Node.js‑capable environment, so any public instance of the affected Parse Server version is susceptible.

The CVSS score of 6.9 indicates moderate severity. The EPSS score of less than 1% suggests a low probability of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw through unauthenticated HTTP requests to the GraphQL endpoint; only knowledge of the public application ID is required to begin the iterative discovery process. Because the issue can be fully remediated by upgrading to a patched version, the risk can be mitigated by following the official fix.