Description
Parse Server versions >= 9.0.0 before 9.10.0-alpha.4 and versions before 8.6.85 contain a schema disclosure vulnerability. When the GraphQL API is mounted with public introspection disabled (graphQLPublicIntrospection: false, the default), schema-derived 'Did you mean ...?' suggestions were still returned in GraphQL error messages produced during variable coercion, which were not covered by the introspection-hardening control (that only handled validation errors). An unauthenticated caller possessing only the public application id can iteratively recover hidden schema identifiers — including registered Cloud Code function names and Parse class and field names — by submitting queries or mutations whose variables contain near-miss enum values or input-object field names. This is a follow-up bypass of GHSA-8cph-rgr4-g5vj. The issue is fixed in 9.10.0-alpha.4 and 8.6.85.
Published: 2026-07-21
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Parse Server versions from 9.0.0 up to but not including 9.10.0-alpha.4, and earlier 8.x releases before 8.6.85, allow unauthenticated callers to recover internal schema identifiers through the GraphQL API. Even when the public introspection feature is disabled, the server emits "Did you mean…?" suggestions in error responses caused by variable coercion, revealing names of Cloud Code functions, Parse classes, and field names. This vulnerability stems from improper handling of validation errors during variable coercion and is classified as CWE‑209.

Affected Systems

The affected product is the open‑source Parse Server community edition. All releases from version 9.0.0 onward through 9.9.x, as well as the 8.x branch up to 8.6.84, are impacted. Deployments that expose the GraphQL endpoint to the public internet are at risk.

Risk and Exploitability

The CVSS score of 6.9 rates the vulnerability as moderate, while the EPSS score of less than 1 % indicates a very low probability of exploitation in production environments. The issue is not listed in CISA's KEV catalog. Attackers only need the public application identifier and can perform enumeration without authentication, making the flaw readily exploitable against any publicly exposed GraphQL endpoint.

Generated by OpenCVE AI on July 30, 2026 at 17:54 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Parse Server to version 9.10.0‑alpha.4 or later, or to 8.6.85 or later to apply the fix for the schema disclosure flaw.
  • Restrict access to the GraphQL endpoint by requiring authentication or applying network‑level controls, thereby preventing unauthenticated enumeration attempts.
  • Enable detailed error logging for GraphQL operations and monitor for repeated "Did you mean…?" patterns that may indicate probing activity.

Generated by OpenCVE AI on July 30, 2026 at 17:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 28 Jul 2026 01:30:00 +0000

Type Values Removed Values Added
First Time appeared Parseplatform
Parseplatform parse-server
CPEs cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*
Vendors & Products Parseplatform
Parseplatform parse-server

Tue, 21 Jul 2026 23:45:00 +0000

Type Values Removed Values Added
First Time appeared Parse Community
Parse Community parse Server
Vendors & Products Parse Community
Parse Community parse Server

Tue, 21 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 21 Jul 2026 12:15:00 +0000

Type Values Removed Values Added
Description Parse Server versions >= 9.0.0 before 9.10.0-alpha.4 and versions before 8.6.85 contain a schema disclosure vulnerability. When the GraphQL API is mounted with public introspection disabled (graphQLPublicIntrospection: false, the default), schema-derived 'Did you mean ...?' suggestions were still returned in GraphQL error messages produced during variable coercion, which were not covered by the introspection-hardening control (that only handled validation errors). An unauthenticated caller possessing only the public application id can iteratively recover hidden schema identifiers — including registered Cloud Code function names and Parse class and field names — by submitting queries or mutations whose variables contain near-miss enum values or input-object field names. This is a follow-up bypass of GHSA-8cph-rgr4-g5vj. The issue is fixed in 9.10.0-alpha.4 and 8.6.85.
Title Parse Server 9.0.0 Schema Disclosure via GraphQL Variable Coercion
Weaknesses CWE-209
References
Metrics cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Parse Community Parse Server
Parseplatform Parse-server
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-07-28T01:05:56.657Z

Reserved: 2026-07-20T11:58:54.524Z

Link: CVE-2026-64627

cve-icon Vulnrichment

Updated: 2026-07-21T13:11:08.231Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-30T18:00:15Z

Weaknesses
  • CWE-209

    Generation of Error Message Containing Sensitive Information