Parse Server versions prior to 9.10.0‑alpha.5 (and prior to 8.6.86) return validation error messages in GraphQL that reveal the names of required (non‑null) custom fields even when schema introspection is disabled. An attacker who merely knows the public application ID and has no user session or privileged keys can trigger validation errors and learn the names of these required fields on classes that the client references by name, partially nullifying the intent of disabling public introspection. No credentials, optional fields, unreferenced class names, or Cloud Code functions are exposed.

The vulnerability affects Parse Server provided by parse-community. Affected versions include all releases from 8.2.2 up to 8.6.85 and from 9.0.0 up to 9.9.9 (the last stable release before 9.10.0‑alpha.5).

The CVSS score of 6.3 indicates medium severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in CISA KEV. Attackers can exploit the flaw from any network position without authentication, relying solely on the publicly available GraphQL endpoint and the application ID. This makes the issuer an unconstrained attacker who can repeatedly trigger validation errors to gather schema details, though the impact is limited to information disclosure rather than direct code execution or data corruption.