Executive brief
Parse Server is a backend service that handles data storage and API management for web and mobile applications. The GraphQL API previously exposed the application's complete data schema to any unauthenticated user, revealing the structure and relationships of all stored data types. Although actual user data was not exposed, attackers could use this schema information to identify potential attack vectors and craft targeted exploits more effectively.
Technical details
This is a sensitive information disclosure vulnerability (CWE-497) in Parse Server's GraphQL API implementation. The vulnerability stems from insufficient access controls on GraphQL introspection queries, which allow unauthenticated attackers to retrieve the complete GraphQL schema without providing a session token or master key. GraphQL introspection is a built-in feature that reveals metadata about the schema, including object types, fields, mutations, and relationships. While introspection alone does not directly expose user data, the exposed schema provides attackers with detailed knowledge of the application's data model, helping them discover exploitation vectors. The vulnerability affects Parse Server versions 5.3.0 to 7.5.2 and 8.0.0 to 8.2.1. Patches have been released requiring master key authentication for schema introspection, with a new optional `graphQLPublicIntrospection` configuration flag that developers can temporarily enable if needed, though this is discouraged.
Affected products
- parse-community parse-server 5.3.0 to 7.5.2, 8.0.0 to 8.2.1
Timeline
- 2025-07-10: disclosed: GHSA-48q3-prgv-gm4w advisory published
- 2025-07-10: patched: Fixes merged for Parse Server 7 (PR #9820) and Parse Server 8 (PR #9819)