Executive brief
Parse Server is an open-source backend framework used to build and host applications. A security issue was identified where the system inadvertently reveals the names of required data fields in its GraphQL API, even when security settings are configured to hide the database structure. While this does not expose actual user data or passwords, it allows unauthorized individuals to map out parts of the application's internal data structure, which could assist in planning more complex attacks.
Technical details
An information disclosure vulnerability exists in Parse Server's GraphQL API implementation. When 'graphQLPublicIntrospection' is set to false (the default), the server still returns verbose validation error messages that explicitly name missing required (non-null) custom input fields. An unauthenticated attacker with only the public application ID can trigger these errors by sending malformed requests to known classes. This bypasses the intended schema-hiding security control, though it is limited to required field names and does not expose stored data, optional fields, or unreferenced classes. The issue is resolved in versions 9.10.0-alpha.5 and 8.6.86 by redacting schema identifiers from error messages for non-privileged callers.
Affected products
- Parse Community Parse Server >= 9.0.0, < 9.10.0-alpha.5; >= 8.2.2, < 8.6.86
Timeline
- 2026-07-10: advisory: GitHub Security Advisory published by maintainers
- 2026-07-24: disclosed: NVD publication date