Information disclosure in Parse-Community Parse-Server

CVE-2026-105828

Parse Server 8.2.2 before 8.6.92 and 9.0.0 before 9.10.1-alpha.12 contains an information disclosure vulnerability in which GraphQL validation error messages reveal hidden class names when public introspection is disabled. Unauthenticated attackers holding only the public Application Id can send crafted operations triggering unknown-argument or invalid enum value errors to learn pointer and relation target classes.

Published 2026-10-08 · last modified 2026-10-08.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Parse-Community Parse-Server

Weakness classification (CWE)

CWE-209 — Generation of Error Message Containing Sensitive Information

References

github.com/parse-community/parse-server/security/advisories/GHSA-6m77-f8xr-f723 (vendor-advisory)
www.vulncheck.com/advisories/parse-server-9.0.0-before-9.10.1-alpha.12-class-na… (third-party-advisory)