Parse Server versions between 9.0.0 and 9.10.0‑alpha.5 and 8.2.2 and 8.6.86 expose Pointer and Relation target class names through GraphQL validation and input‑coercion error messages. The error responses are generated before authentication and resolver execution, so any user with the public application ID can trigger them to reconstruct hidden schema class names. The vulnerability maps to CWE‑209, which describes information exposure through error messages. Although no object data, credentials or user records are disclosed, the leakage of class names undermines schema‑hiding protections and could aid attackers in building a more detailed attack surface.

The affected product is Parse Server (parse-community:parse-server). Version ranges affected are Parse Server 9.0.0 up to, but not including, 9.10.0‑alpha.6 and Parse Server 8.2.2 up to, but not including, 8.6.87. All deployments that use the default setting graphQLPublicIntrospection: false are impacted.

The CVSS score of 6.3 indicates moderate severity. The EPSS score of less than 1 % suggests that exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an unauthenticated client sending malformed or intentionally problematic GraphQL requests to the server’s GraphQL endpoint, causing the server to return detailed error messages that contain the target class names.