CVE-2026-64627

Name of the Vulnerable Software and Affected Versions Parse Server versions 9.0.0 through 9.10.0-alpha.3 Parse Server versions prior to 8.6.85

Description A schema disclosure issue exists when the GraphQL API is configured with graphQLPublicIntrospection set to false. Error messages generated during variable coercion continue to provide schema-derived suggestions, bypassing the introspection-hardening control. An unauthenticated user with the public application id can iteratively recover hidden schema identifiers, such as Parse class and field names and registered Cloud Code function names, by submitting queries or mutations with near-miss enum values or input-object field names.

Recommendations Update to version 9.10.0-alpha.4 or later. Update to version 8.6.85 or later.