PT-2026-107987

CVE-2026-105828

Published

2026-10-08

Updated

2026-10-16

Description by

CVSS 4.0

6.3

Medium

MetricsAV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Parse Server versions 8.2.2 through 8.6.91 Parse Server versions 9.0.0 through 9.10.1-alpha.11

Description An information disclosure issue exists where GraphQL validation error messages reveal hidden class names even when public introspection is disabled. Unauthenticated attackers with the public Application Id can send crafted operations to trigger unknown-argument or invalid enum value errors, allowing them to discover pointer and relation target classes.

Recommendations Update Parse Server to version 8.6.92 or later. Update Parse Server to version 9.10.1-alpha.12 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Arpitjain099

Mtrezza

Vendors

Affected products

Weakness enumeration

CWE-209: Generation of Error Message Containing Sensitive Information