Executive brief
Parse Server is an open-source backend framework used to build mobile and web applications. A security issue in its GraphQL interface allows unauthorized users to discover the names of internal data tables (classes) even when security settings are configured to hide them. While this does not expose actual user data or passwords, it reveals the structure of the database, which can be used by attackers to plan more targeted attacks.
Technical details
An information disclosure vulnerability exists in Parse Server's GraphQL API due to improper error message sanitization during validation and input coercion. When 'graphQLPublicIntrospection' is disabled, the server still returns error messages that embed the names of classes targeted by Pointer and Relation fields. Because these errors are generated before authentication or authorization checks occur, an unauthenticated attacker with only the application ID can systematically trigger these errors to map out the hidden schema. This partially bypasses schema-hiding protections, though it does not grant access to actual object data. The issue is fixed in versions 9.10.0-alpha.6 and 8.6.87 by extending the error-message sanitizer to redact schema type identifiers.
Affected products
- Parse Community Parse Server >= 9.0.0, < 9.10.0-alpha.6; >= 8.2.2, < 8.6.87
Timeline
- 2026-07-10: advisory: GitHub advisory GHSA-r2g6-4f6j-f6rf published
- 2026-07-24: disclosed: NVD publication date