CVE-2026-109302
Received Received - Intake

Parse Server GraphQL Introspection Bypass via APQ Cache

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 applies its GraphQL introspection control only to operation text sent directly with a request, not to operations resolved from Apollo Server's automatic persisted query cache. Unauthenticated attackers holding the public Application Id and client key can replay an introspection query previously cached by a master or maintenance key client to retrieve the schema, including private class and field names.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109302
EUVD
EUVD-2026-97604

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
parse-community parse-server 9.0.0
parse-community parse-server 8.2.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Parse Server versions 8.2.2 through 8.6.93 and 9.0.0 through 9.10.1-alpha.14 have a flaw where GraphQL introspection controls only apply to direct requests, not to operations retrieved from Apollo Server's automatic persisted query cache. Unauthenticated attackers with the public Application ID and client key can replay cached introspection queries from privileged clients to obtain the schema, including private class and field names.

Detection Guidance

Check if your Parse Server version is within the vulnerable range (8.2.2 to 8.6.93 or 9.0.0 to 9.10.1-alpha.14). Inspect Apollo Server's persisted query cache for introspection queries. Monitor GraphQL API logs for repeated introspection requests from unauthorized clients.

Impact Analysis

An attacker could gain access to sensitive schema details, including private class and field names, potentially exposing internal application structure. This does not directly expose user data but may aid in further attacks by revealing system design or weaknesses.

Compliance Impact

This vulnerability may impact compliance by exposing internal schema details that could indirectly reveal information about data storage or processing, potentially violating confidentiality requirements in GDPR or HIPAA. However, user data itself is not exposed.

Mitigation Strategies

Upgrade Parse Server to a patched version (>= 8.6.94 or >= 9.10.1-alpha.14). Restart the server to clear the persisted query cache. Disable automatic persisted queries for privileged clients. Set NODE_ENV to production if not already configured.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109302. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart