GraphQL Information Disclosure in Parse Server by Parse Community

CVE-2026-66009

What is CVE-2026-66009?

Certain versions of Parse Server incorrectly return GraphQL validation error messages that disclose the names of required custom input fields when public introspection is disabled. This can allow a client with only the public application ID to trigger validation errors and learn the names of non-null custom fields on referenced classes. Despite the intended schema-hiding feature, the exposure of custom field names poses a risk to data confidentiality, although no sensitive user data or other internal identifiers are revealed.

References