CVE-2026-66008

Name of the Vulnerable Software and Affected Versions Parse Server versions 9.0.0 through 9.10.0-alpha.5 Parse Server versions 8.2.2 through 8.6.86

Description An issue exists where Pointer and Relation target class names are disclosed through GraphQL validation and input-coercion error messages. This occurs when public schema introspection is disabled via the graphQLPublicIntrospection variable. Since these errors are generated before authentication, authorization, or resolver execution, an unauthenticated client with the public application ID can trigger errors on Pointer or Relation fields to reconstruct hidden schema class names. This partially bypasses schema-hiding protections, although only schema metadata is exposed, and no object data, credentials, or user records are disclosed.

Recommendations Update Parse Server to version 9.10.0-alpha.6 or later. Update Parse Server to version 8.6.87 or later.