Back to overview

CVE-2026-66008

MEDIUM
6.3
CVSS 4.0
Description
Parse Server versions >= 9.0.0 before 9.10.0-alpha.6 and >= 8.2.2 before 8.6.87 disclose Pointer and Relation target class names through GraphQL validation and input-coercion error messages when public schema introspection is disabled (graphQLPublicIntrospection: false, the default). Because these errors are produced before authentication, authorization, or any resolver runs, an unauthenticated client possessing only the public application ID can trigger errors on Pointer or Relation fields to reconstruct hidden schema class names, partially defeating the schema-hiding protection. Only schema metadata (class names) is exposed; no object data, credentials, or user records are disclosed.

Metadata

CVE ID
CVE-2026-66008
State
PUBLISHED
Assigner
VulnCheck
Reserved
2026-07-23 19:22 UTC
Published
2026-07-24 12:07 UTC
Last updated
2026-07-24 13:38 UTC
Primary CWE
CWE-209
Generation of Error Message Containing Sensitive Information
Vendor / Product
parse-community / parse-server
Sources
cve.org  ·  NVD

Severity & Metrics

6.3 MEDIUM CVSS 4.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
SSVC — CISA Coordinator
Exploitation
none
Automatable
no
Tech. Impact
partial
Affected products (2)
VendorProductPlatformVersions
parse-community parse-server — 9.0.0 < 9.10.0-alpha.6, 9.10.0-alpha.6
parse-community parse-server — 8.2.2 < 8.6.87, 8.6.87
Weakness (CWE)
CWESourceDescription
CWE-209 cna Generation of Error Message Containing Sensitive Information
CVSS scores (1)
ScoreSeverityVersionSourceVector
6.3 MEDIUM 4.0 cna CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
References (2)
Back to overview