CVE-2026-109302

Name of the Vulnerable Software and Affected Versions Parse Server versions 8.2.2 through 8.6.93 Parse Server versions 9.0.0 through 9.10.1-alpha.13

Description GraphQL introspection control is only applied to operation text sent directly with a request and does not extend to operations resolved from the Apollo Server automatic persisted query cache. This allows unauthenticated attackers with the public Application Id and client key to replay an introspection query previously cached by a client using a master or maintenance key to retrieve the schema, which may include private class and field names.

Recommendations Update Parse Server to version 8.6.94 or later. Update Parse Server to version 9.10.1-alpha.14 or later.