CVE-2026-66009 in parse-server
Summary
by MITRE • 07/24/2026
Parse Server versions >= 9.0.0 before 9.10.0-alpha.5 and >= 8.2.2 before 8.6.86 return GraphQL validation error messages that name required custom input fields even when public introspection is disabled (graphQLPublicIntrospection: false, the default). A client holding only the public application id — with no user session, master key, or maintenance key — can trigger validation errors to learn the names of required (non-null) custom fields on classes it already references by name, partially defeating the schema-hiding intent of disabling public introspection. No stored data, credentials, optional field names, unreferenced class names, or Cloud Code function names are exposed.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/24/2026
This vulnerability exists in Parse Server versions between 9.0.0 and 9.10.0-alpha.5, as well as versions between 8.2.2 and 8.6.86 where the GraphQL public introspection feature is disabled. The flaw manifests when clients with only a public application id attempt to interact with GraphQL endpoints, specifically triggering validation errors that inadvertently reveal information about required custom input fields on classes they can reference. This represents a violation of the principle of least privilege and information hiding that should be maintained even when introspection is disabled.
The technical implementation of this vulnerability stems from how Parse Server handles GraphQL validation responses under restricted access conditions. When public introspection is disabled through the graphQLPublicIntrospection: false configuration, the system should prevent unauthorized discovery of schema details including required field names. However, the validation error messages still contain sufficient information to disclose which custom fields are required for specific classes, effectively bypassing the intended security controls. This behavior aligns with CWE-200, Information Exposure, and demonstrates how incomplete access control implementation can lead to information leakage.
The operational impact of this vulnerability is significant for applications relying on Parse Server's schema hiding capabilities. An attacker with only a public application id can systematically query the GraphQL endpoint to discover required fields on various classes they already know about through normal referencing. This partial exposure of schema structure undermines the security model where only authorized users should be able to understand the complete data model, even if they cannot access actual data or perform operations beyond their privileges. The vulnerability affects the confidentiality aspect of the security triad by leaking structural information that could aid in planning more sophisticated attacks.
Organizations should immediately upgrade to Parse Server versions 9.10.0-alpha.5 or later for version 9.x, and 8.6.86 or later for version 8.x to address this vulnerability. Additionally, administrators should review their GraphQL configuration settings and ensure that graphQLPublicIntrospection is properly set to false in production environments. The mitigation strategy should include implementing network-level restrictions and monitoring for unusual GraphQL query patterns that might indicate attempts to enumerate required fields. This issue demonstrates the importance of comprehensive security testing beyond basic functionality verification, particularly when dealing with GraphQL endpoints where error messages can inadvertently leak information about internal system structure. Organizations should also consider implementing additional access controls and rate limiting mechanisms to prevent automated enumeration attacks targeting GraphQL validation endpoints.