CVE-2026-64627
Received Received - Intake

Schema Disclosure in Parse Server via GraphQL Error Messages

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: VulnCheck

Description
Parse Server versions >= 9.0.0 before 9.10.0-alpha.4 and versions before 8.6.85 contain a schema disclosure vulnerability. When the GraphQL API is mounted with public introspection disabled (graphQLPublicIntrospection: false, the default), schema-derived 'Did you mean ...?' suggestions were still returned in GraphQL error messages produced during variable coercion, which were not covered by the introspection-hardening control (that only handled validation errors). An unauthenticated caller possessing only the public application id can iteratively recover hidden schema identifiers — including registered Cloud Code function names and Parse class and field names — by submitting queries or mutations whose variables contain near-miss enum values or input-object field names. This is a follow-up bypass of GHSA-8cph-rgr4-g5vj. The issue is fixed in 9.10.0-alpha.4 and 8.6.85.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-21
Last Modified
2026-07-21
Generated
2026-07-21
AI Q&A
2026-07-21
EPSS Evaluated
N/A
NVD
CVE-2026-64627
EUVD
EUVD-2026-46180

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
parse parse_server From 9.0.0 (inc) to 9.10.0-alpha.4 (exc)
parse parse_server to 8.6.85 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-209 The product generates an error message that includes sensitive information about its environment, users, or associated data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Parse Server versions >=9.0.0 before 9.10.0-alpha.4 and versions before 8.6.85. It allows unauthenticated attackers with only the public application ID to recover hidden schema identifiers like Cloud Code function names and Parse class or field names by exploiting error messages during GraphQL variable coercion. Even when GraphQL introspection is disabled, error messages still include schema-derived suggestions such as 'Did you mean...?' prompts.

Detection Guidance

To detect this vulnerability, monitor GraphQL API error responses for 'Did you mean...?' suggestions in variable coercion failures. Use tools like curl to send test queries with near-miss enum values or field names and check for schema-derived hints in error messages. Example: curl -X POST -H 'Content-Type: application/json' -d '{"query":"mutation { test(input: {field: INVALID }) { result } }","variables":{}}' http://your-parse-server/graphql

Impact Analysis

An attacker could use this vulnerability to iteratively discover sensitive schema details, potentially leading to further exploits like unauthorized data access or code execution. The attack requires low complexity and no privileges or user interaction, making it relatively easy to exploit. The exposed schema information could help attackers craft more targeted attacks against the application.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements under GDPR and HIPAA. Exposure of schema details may indicate insufficient data protection measures, potentially resulting in compliance violations and regulatory penalties.

Mitigation Strategies

Immediately upgrade Parse Server to versions 9.10.0-alpha.4 or 8.6.85 or later. As a temporary workaround, restrict network access to the GraphQL endpoint or enforce authentication for all GraphQL requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64627. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart