Information Disclosure in Parse Server by Parse Community

CVE-2026-66008

What is CVE-2026-66008?

Certain versions of Parse Server are susceptible to an information disclosure vulnerability that reveals Pointer and Relation class names through unhandled GraphQL validation errors. When the public schema introspection is disabled, error messages produced allow an unauthenticated client, using only the public application ID, to trigger errors that reveal underlying schema class names. This exposure can undermine the intended schema-hiding protection; however, it does not compromise object data or user credentials.

References