CVE-2026-66008: Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages
Parse Server versions >= 9.0.0 before 9.10.0-alpha.6 and >= 8.2.2 before 8.6.87 disclose Pointer and Relation target class names through GraphQL validation and input-coercion error messages when public schema introspection is disabled (graphQLPublicIntrospection: false, the default). Because these errors are produced before authentication, authorization, or any resolver runs, an unauthenticated client possessing only the public application ID can trigger errors on Pointer or Relation fields to reconstruct hidden schema class names, partially defeating the schema-hiding protection. Only schema metadata (class names) is exposed; no object data, credentials, or user records are disclosed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Parse Serverto a version that resolves this vulnerability.Fixed in 9.10.0-alpha.6 - Upgrade
Upgrade
Parse Serverto a version that resolves this vulnerability.Fixed in 8.6.87 - Configuration
Ensure graphQLPublicIntrospection is set to false (default) to prevent public schema introspection; note that versions >= 9.0.0 before 9.10.0-alpha.6 and >= 8.2.2 before 8.6.87 may still disclose Pointer/Relation target class names via GraphQL error messages even when public introspection is disabled.
Parse Server GraphQL graphQLPublicIntrospection = false
Event History
Frequently Asked Questions
What is the severity of CVE-2026-66008?
The severity of CVE-2026-66008 is rated as medium with a score of 6.3.
How do I fix CVE-2026-66008?
To fix CVE-2026-66008, upgrade your Parse Server to version 9.10.0-alpha.6 or higher, or to version 8.6.87 or higher.
What does CVE-2026-66008 affect?
CVE-2026-66008 affects Parse Server versions 9.0.0 to 9.10.0-alpha.6 and 8.2.2 to 8.6.87.
What type of vulnerability is CVE-2026-66008?
CVE-2026-66008 is an information disclosure vulnerability caused by GraphQL error messages.
Is public schema introspection required to exploit CVE-2026-66008?
Yes, CVE-2026-66008 can be exploited when public schema introspection is disabled.