Information disclosure in Parse-community Parse-server
CVE-2026-66009
Parse Server versions >= 9.0.0 before 9.10.0-alpha.5 and >= 8.2.2 before 8.6.86 return GraphQL validation error messages that name required custom input fields even when public introspection is disabled (graphQLPublicIntrospection: false…
Affected products
- Parse-community Parse-server — versions 9.0.0, 9.10.0-alpha.5, 8.2.2
Weakness classification (CWE)
References
- disclosure@vulncheck.com (vendor-advisory)
- disclosure@vulncheck.com (third-party-advisory)