GraphQL Schema Disclosure in Parse Server Versions 8.2.2 to 9.0.0
CVE-2026-109302

6.3MEDIUM

Key Information:

Vendor

Parse-community

Status
Parse-server
Vendor
CVE Published:
12 October 2026

What is CVE-2026-109302?

A security issue exists in Parse Server versions 8.2.2 through 8.6.94 and 9.0.0 through 9.10.1-alpha.14 where GraphQL introspection controls are insufficiently applied. This flaw allows unauthenticated attackers with access to a public Application Id and client key to exploit the automatic persisted query cache of Apollo Server, potentially revealing sensitive schema data, including private classes and fields. The vulnerability emphasizes the need for enhanced security measures to protect confidential schema information from unauthorized exposure.

Affected Version(s)

parse-server 9.0.0 < 9.10.1-alpha.14

parse-server 8.2.2 < 8.6.94

parse-server 9.10.1-alpha.14

References

https://github.com/parse-community/parse-server/security/...
vendor-advisory
https://www.vulncheck.com/advisories/parse-server-8.2.2-b...
third-party-advisory

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

mtrezza
.