Executive brief
Parse Server is a Node.js backend framework that provides GraphQL API functionality. When administrators disable public GraphQL introspection for security, a weakness in the validation logic allows unauthenticated attackers to bypass this control by nesting __type queries inside inline fragments, enabling them to discover the GraphQL schema and data types without authentication.
Technical details
Parse Server contains an authorization bypass vulnerability in its GraphQL introspection control mechanism (CWE-863). When graphQLPublicIntrospection is disabled to restrict schema discovery, the server only performs a flat iteration over root-level query selections but fails to recursively inspect nested inline fragments. An attacker can craft a GraphQL query with __type introspection nested inside inline fragments (e.g., "... on Query { __type(name:"User") { name } }") to bypass the introspection check and perform type reconnaissance without authentication. The __schema introspection is unaffected. The vulnerability was introduced in Parse Server 9.3.1-alpha.3 and patched in 9.5.0-alpha.10 by implementing a recursive walk of all selection sets rather than flat iteration.
Affected products
- Parse Community Parse Server >=9.3.1-alpha.3, <9.5.0-alpha.10
Timeline
- 2026-03-07: disclosed
- 2026-03-09: patched: version 9.5.0-alpha.10