CVE-2026-64627
mediumpriority · track · 0EPSS 0.005 · 41 %ileEUUSEPSS · scored 2026-10-27
Parse Server versions >= 9.0.0 before 9.10.0-alpha.4 and versions before 8.6.85 contain a schema disclosure vulnerability. When the GraphQL API is mounted with public introspection disabled (graphQLPublicIntrospection: false, the default), schema-derived 'Did you mean ...?' suggestions were still returned in GraphQL error messages produced during variable coercion, which were not covered by the introspection-hardening control (that only handled validation errors). An unauthenticated caller possessing only the public application id can iteratively recover hidden schema identifiers — including registered Cloud Code function names and Parse class and field names — by submitting queries or mutations whose variables contain near-miss enum values or input-object field names. This is a follow-up bypass of GHSA-8cph-rgr4-g5vj. The issue is fixed in 9.10.0-alpha.4 and 8.6.85.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–medium · 2.7–6.9
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (4)
Products and version ranges known to be affected.
advisories (1)
Vendor and ecosystem advisories describing this.
- BIT-parse-2026-64627Parse Server 9.0.0 Schema Disclosure via GraphQL Variable Coercion2026-09-25vendor · osvUS
Parse Server versions >= 9.0.0 before 9.10.0 and versions before 8.6.85 contain a schema disclosure vulnerability. When the GraphQL API is mounted with public introspection disabled (graphQLPublicIntrospection: false, the default), schema-derived 'Did you mean ...?' suggestions were still returned in GraphQL error messages produced during variable coercion, which were not covered by the introspection-hardening control (that only handled validation errors). An unauthenticated caller possessing only the public application id can iteratively recover hidden schema identifiers — including registered Cloud Code function names and Parse class and field names — by submitting queries or mutations whose variables contain near-miss enum values or input-object field names. This is a follow-up bypass of GHSA-8cph-rgr4-g5vj. The issue is fixed in 9.10.0 and 8.6.85.
also known as (4)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (6)
External citations — patches, advisories, analysis.
- https://github.com/parse-community/parse-server/security/advisories/GHSA-9g8f-h8f3-hjcmcnnvd
- https://www.vulncheck.com/advisories/parse-server-schema-disclosure-via-graphql-variable-coercioncnnvd
- https://github.com/parse-community/parse-server/security/advisories/GHSA-9g8f-h8f3-hjcmenisa_euvd
- https://www.vulncheck.com/advisories/parse-server-schema-disclosure-via-graphql-variable-coercionenisa_euvd
- https://github.com/parse-community/parse-server/security/advisories/GHSA-9g8f-h8f3-hjcmnvd
- https://www.vulncheck.com/advisories/parse-server-schema-disclosure-via-graphql-variable-coercionnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan