# CVE-2026-66008: Parse Community Parse Server information disclosure in GraphQL error messages

Source: https://junglewise.ai/threats/cve-2026-66008-parse-community-parse-server-information-disclosure-in-graphql  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-24. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-66008 · Severity: info · CVSS 6.3 · Published 2026-07-24

Parse Server is an open-source backend framework used to build mobile and web applications. A security issue in its GraphQL interface allows unauthorized users to discover the names of internal data tables (classes) even when security settings are configured to hide them. While this does not expose actual user data or passwords, it reveals the structure of the database, which can be used by attackers to plan more targeted attacks.

## Quick answers

**Is CVE-2026-66008 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-66008 being exploited in the wild.

**How severe is CVE-2026-66008?** Informational severity, with a CVSS score of 6.3, published 24 July 2026.

**Which products and versions are affected?** Parse Community Parse Server >= 9.0.0, < 9.10.0-alpha.6; >= 8.2.2, < 8.6.87.

**Is there a fix for CVE-2026-66008?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-66008 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-66008?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An information disclosure vulnerability exists in Parse Server's GraphQL API due to improper error message sanitization during validation and input coercion. When 'graphQLPublicIntrospection' is disabled, the server still returns error messages that embed the names of classes targeted by Pointer and Relation fields. Because these errors are generated before authentication or authorization checks occur, an unauthenticated attacker with only the application ID can systematically trigger these errors to map out the hidden schema. This partially bypasses schema-hiding protections, though it does not grant access to actual object data. The issue is fixed in versions 9.10.0-alpha.6 and 8.6.87 by extending the error-message sanitizer to redact schema type identifiers.

## Affected products

- Parse Community Parse Server >= 9.0.0, < 9.10.0-alpha.6; >= 8.2.2, < 8.6.87

## Timeline

- 2026-07-10: advisory: GitHub advisory GHSA-r2g6-4f6j-f6rf published
- 2026-07-24: disclosed: NVD publication date

## References

- [https://github.com/parse-community/parse-server/security/advisories/GHSA-r2g6-4f6j-f6rf](https://github.com/parse-community/parse-server/security/advisories/GHSA-r2g6-4f6j-f6rf)
- [https://www.vulncheck.com/advisories/parse-server-information-disclosure-via-graphql-error-messages](https://www.vulncheck.com/advisories/parse-server-information-disclosure-via-graphql-error-messages)