CVE-2026-66009
Received Received - Intake

Parse Server GraphQL Validation Exposes Custom Field Names

Publication date: 2026-07-24

Last updated on: 2026-07-24

Assigner: VulnCheck

Description
Parse Server versions >= 9.0.0 before 9.10.0-alpha.5 and >= 8.2.2 before 8.6.86 return GraphQL validation error messages that name required custom input fields even when public introspection is disabled (graphQLPublicIntrospection: false, the default). A client holding only the public application id — with no user session, master key, or maintenance key — can trigger validation errors to learn the names of required (non-null) custom fields on classes it already references by name, partially defeating the schema-hiding intent of disabling public introspection. No stored data, credentials, optional field names, unreferenced class names, or Cloud Code function names are exposed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-24
Last Modified
2026-07-24
Generated
2026-07-24
AI Q&A
2026-07-24
EPSS Evaluated
N/A
NVD
CVE-2026-66009
EUVD
EUVD-2026-48581

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
parse parse_server From 9.0.0 (inc) to 9.10.0-alpha.5 (exc)
parse parse_server From 8.2.2 (inc) to 8.6.86 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-209 The product generates an error message that includes sensitive information about its environment, users, or associated data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Parse Server versions 9.0.0 to 9.10.0-alpha.4 and 8.2.2 to 8.6.85. When public GraphQL introspection is disabled (default setting), error messages still reveal the names of required custom input fields on classes referenced by an attacker. This partially defeats the purpose of disabling introspection, as it exposes schema details to unauthenticated users with only the public application ID.

Detection Guidance

To detect this vulnerability, check if your Parse Server version is within the affected range (9.0.0 to 9.10.0-alpha.4 or 8.2.2 to 8.6.85). Use commands like 'npm list parse-server' or check your package.json to verify the installed version. Additionally, test GraphQL error responses for disclosure of required field names by sending queries with missing required fields.

  • Check Parse Server version: npm list parse-server or inspect package.json.
  • Send test GraphQL queries with missing required fields to observe error messages for field names.
Impact Analysis

An attacker could learn the names of required fields on classes they already know about, which may help in further attacks like crafting more precise queries or understanding the application's data structure. However, stored data, credentials, optional fields, and other schema details remain hidden.

Compliance Impact

This vulnerability could impact compliance by exposing parts of the application schema, which might be considered sensitive information under GDPR or HIPAA. While no stored data is exposed, the disclosure of required field names could be seen as a partial breach of data protection principles, depending on the context and interpretation of the regulations.

Mitigation Strategies

Immediately upgrade Parse Server to a patched version (9.10.0-alpha.5 or later, or 8.6.86 or later). If upgrading is not possible, restrict access to the GraphQL endpoint as a temporary measure to limit exposure.

  • Upgrade Parse Server to version 9.10.0-alpha.5+ or 8.6.86+.
  • Temporarily restrict GraphQL endpoint access if upgrading is delayed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-66009. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart