Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages
Parse Server versions >= 9.0.0 before 9.10.0-alpha.5 and >= 8.2.2 before 8.6.86 return GraphQL validation error messages that name required custom input fields even when public introspection is disabled (graphQLPublicIntrospection: false, the default). A client holding only the public application id — with no user session, master key, or maintenance key — can trigger validation errors to learn the names of required (non-null) custom fields on classes it already references by name, partially defeating the schema-hiding intent of disabling public introspection. No stored data, credentials, optional field names, unreferenced class names, or Cloud Code function names are exposed.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-66009
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 07:47 UTC · Revision 1
Source evidence
Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages
core-osv · Original sourcePublished 24 Jul 2026, 12:07 UTC
Parse Server versions >= 9.0.0 before 9.10.0-alpha.5 and >= 8.2.2 before 8.6.86 return GraphQL validation error messages that name required custom input fields even when public introspection is disabled (graphQLPublicIntrospection: false, the default). A client holding only the public application id — with no user session, master key, or maintenance key — can trigger validation errors to learn the names of required (non-null) custom fields on classes it already references by name, partially defeating the schema-hiding intent of disabling public introspection. No stored data, credentials, optional field names, unreferenced class names, or Cloud Code function names are exposed.
osv:CVE-2026-66009
Complete source record
{
"id": "1be59b46d43920255fac50314b3dbbbf8d65c55a5533e6cd4aed5b049a29df35",
"url": "https://osv.dev/vulnerability/CVE-2026-66009",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages",
"summary": "Parse Server versions >= 9.0.0 before 9.10.0-alpha.5 and >= 8.2.2 before 8.6.86 return GraphQL validation error messages that name required custom input fields even when public introspection is disabled (graphQLPublicIntrospection: false, the default). A client holding only the public application id — with no user session, master key, or maintenance key — can trigger validation errors to learn the names of required (non-null) custom fields on classes it already references by name, partially defeating the schema-hiding intent of disabling public introspection. No stored data, credentials, optional field names, unreferenced class names, or Cloud Code function names are exposed.",
"evidence": "osv:CVE-2026-66009",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2026-66009",
"aliases": [
"BIT-parse-2026-66009",
"CVE-2026-66009",
"GHSA-2fgh-8j2g-w354"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/parse-community/parse-server",
"type": "GIT",
"events": [
{
"introduced": "532a461d30a6ed4457839f2caf5f30d5abf51a55"
},
{
"fixed": "3fa545f5901a84240ae05505a8688d468122b7a9"
},
{
"introduced": "e3f5ae0be78361daffee9e8bde148906e9b878f9"
},
{
"fixed": "c14da8141b60ebba71ffe709f1d927835ee971f5"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "9.0.0"
},
{
"fixed": "9.10.0-alpha.5"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
},
{
"range": [
{
"introduced": "8.2.2"
},
{
"fixed": "8.6.86"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
}
]
}
}
],
"versions": [
"9.9.0",
"8.6.85",
"9.10.0-alpha.4",
"8.6.84",
"9.10.0-alpha.3",
"9.10.0-alpha.2",
"8.6.83",
"9.10.0-alpha.1",
"9.9.1-alpha.13",
"8.6.82",
"9.9.1-alpha.12",
"8.6.81",
"9.9.1-alpha.11",
"8.6.80",
"9.9.1-alpha.10",
"9.9.1-alpha.9",
"9.9.1-alpha.8",
"9.9.1-alpha.7",
"9.9.1-alpha.6",
"8.6.79",
"9.9.1-alpha.5",
"9.9.1-alpha.4",
"8.6.78",
"9.9.1-alpha.3",
"9.9.1-alpha.2",
"8.6.77",
"9.9.1-alpha.1",
"8.6.76",
"9.8.0",
"8.6.75",
"9.7.0",
"8.6.74",
"8.6.73",
"8.6.72",
"8.6.71",
"8.6.70",
"9.6.1",
"8.6.69",
"8.6.68",
"8.6.67",
"8.6.66",
"8.6.65",
"8.6.64",
"8.6.63",
"8.6.62",
"9.6.0",
"9.5.1",
"8.6.61",
"8.6.60",
"8.6.59",
"8.6.58",
"8.6.57",
"8.6.56",
"8.6.55",
"8.6.54",
"8.6.53",
"8.6.52",
"8.6.51",
"8.6.50",
"8.6.49",
"8.6.48",
"8.6.47",
"8.6.46",
"8.6.45",
"8.6.44",
"8.6.43",
"8.6.42",
"8.6.41",
"8.6.40",
"8.6.39",
"8.6.38",
"8.6.37",
"8.6.36",
"8.6.35",
"8.6.34",
"8.6.33",
"8.6.32",
"8.6.31",
"8.6.30",
"8.6.29",
"8.6.28",
"8.6.27",
"8.6.26",
"8.6.25",
"8.6.24",
"8.6.23",
"8.6.22",
"8.6.21",
"8.6.20",
"8.6.19",
"8.6.18",
"8.6.17",
"8.6.16",
"8.6.15",
"8.6.14",
"8.6.13",
"9.5.0",
"8.6.12",
"8.6.11",
"9.4.1",
"8.6.10",
"8.6.9",
"8.6.8",
"8.6.7",
"8.6.6",
"8.6.5",
"8.6.4",
"9.4.0",
"8.6.3",
"9.3.1",
"9.3.0",
"8.6.2",
"9.2.0",
"9.1.1",
"9.1.0",
"8.6.1",
"9.0.0",
"8.6.0",
"8.5.0",
"8.4.0",
"8.3.0",
"8.2.5",
"8.2.4",
"8.2.3",
"8.2.2"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-66009.json"
}
}
],
"modified": "2026-10-28T02:30:26.852373111Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/66xxx/CVE-2026-66009.json",
"https://github.com/parse-community/parse-server/security/advisories/GHSA-2fgh-8j2g-w354",
"https://nvd.nist.gov/vuln/detail/CVE-2026-66009",
"https://www.vulncheck.com/advisories/parse-server-information-disclosure-via-graphql-error-messages-2"
],
"provider_metadata": {
"cwe_ids": [
"CWE-209"
],
"cna_assigner": "VulnCheck",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/66xxx/CVE-2026-66009.json"
}
},
"related_cves": [
{
"value": "CVE-2026-66009",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 493525,
"published_at": "2026-07-24T12:07:56.72+00:00"
}