CVE-2026-66008
Received Received - Intake

Pointer and Relation Class Name Disclosure in Parse Server

Publication date: 2026-07-24

Last updated on: 2026-07-24

Assigner: VulnCheck

Description
Parse Server versions >= 9.0.0 before 9.10.0-alpha.6 and >= 8.2.2 before 8.6.87 disclose Pointer and Relation target class names through GraphQL validation and input-coercion error messages when public schema introspection is disabled (graphQLPublicIntrospection: false, the default). Because these errors are produced before authentication, authorization, or any resolver runs, an unauthenticated client possessing only the public application ID can trigger errors on Pointer or Relation fields to reconstruct hidden schema class names, partially defeating the schema-hiding protection. Only schema metadata (class names) is exposed; no object data, credentials, or user records are disclosed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-24
Last Modified
2026-07-24
Generated
2026-07-24
AI Q&A
2026-07-24
EPSS Evaluated
N/A
NVD
CVE-2026-66008
EUVD
EUVD-2026-48580

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
parse_community parse_server From 9.0.0 (inc) to 9.10.0-alpha.6 (exc)
parse_community parse_server From 8.2.2 (inc) to 8.6.87 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-209 The product generates an error message that includes sensitive information about its environment, users, or associated data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Parse Server versions >= 9.0.0 before 9.10.0-alpha.6 and >= 8.2.2 before 8.6.87. It allows unauthenticated users with only the public application ID to trigger GraphQL validation errors that disclose Pointer and Relation target class names through error messages. This happens even when public schema introspection is disabled, partially defeating schema-hiding protection. Only schema metadata (class names) is exposed; no object data or credentials are disclosed.

Detection Guidance

To detect this vulnerability, check your Parse Server version against the affected ranges (>=9.0.0, <9.10.0-alpha.6 or >=8.2.2, <8.6.87). Use commands like 'npm list parse-server' or inspect your package.json to verify the installed version.

Impact Analysis

An attacker could use this vulnerability to infer hidden schema class names in your Parse Server application. This undermines your schema-hiding protection and may help attackers plan further attacks by understanding your database structure. However, no actual data, credentials, or user records are exposed.

Compliance Impact

This vulnerability may impact compliance by exposing schema metadata that could indirectly reveal information about data structures. While no direct data exposure occurs, regulators might view schema disclosure as a potential risk to data confidentiality principles in GDPR or HIPAA. The impact depends on specific compliance requirements and how schema hiding is implemented in your system.

Mitigation Strategies

Upgrade Parse Server to version 9.10.0-alpha.6 or 8.6.87 or later. Alternatively, disable the GraphQL API entirely if upgrading is not feasible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-66008. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart