Information disclosure in Parse-community Parse-server
CVE-2026-66008
Parse Server versions >= 9.0.0 before 9.10.0-alpha.6 and >= 8.2.2 before 8.6.87 disclose Pointer and Relation target class names through GraphQL validation and input-coercion error messages when public schema introspection is disabled (gra…
Affected products
- Parse-community Parse-server — versions 9.0.0, 9.10.0-alpha.6, 8.2.2
Weakness classification (CWE)
References
- disclosure@vulncheck.com (vendor-advisory)
- disclosure@vulncheck.com (third-party-advisory)