CVE-2026-66009

Full vulnerability record from the local CVENow database.

Description

Parse Server versions >= 9.0.0 before 9.10.0-alpha.5 and >= 8.2.2 before 8.6.86 return GraphQL validation error messages that name required custom input fields even when public introspection is disabled (graphQLPublicIntrospection: false, the default). A client holding only the public application id — with no user session, master key, or maintenance key — can trigger validation errors to learn the names of required (non-null) custom fields on classes it already references by name, partially defeating the schema-hiding intent of disabling public introspection. No stored data, credentials, optional field names, unreferenced class names, or Cloud Code function names are exposed.

Severity

MEDIUM

CVSS score

6.3 (v4.0)

Vulnerability status

Deferred

Source identifier

[email protected]

Published

2026-07-24 13:18:28.580000

Last modified

2026-10-24 13:10:00.147000

View original CVE JSON

{
  "id": "CVE-2026-66009",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-24T13:18:28.580",
  "lastModified": "2026-10-24T13:10:00.147",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Parse Server versions >= 9.0.0 before 9.10.0-alpha.5 and >= 8.2.2 before 8.6.86 return GraphQL validation error messages that name required custom input fields even when public introspection is disabled (graphQLPublicIntrospection: false, the default). A client holding only the public application id — with no user session, master key, or maintenance key — can trigger validation errors to learn the names of required (non-null) custom fields on classes it already references by name, partially defeating the schema-hiding intent of disabling public introspection. No stored data, credentials, optional field names, unreferenced class names, or Cloud Code function names are exposed."
    },
    {
      "lang": "es",
      "value": "Las versiones de Parse Server iguales o superiores a 9.0.0 anteriores a 9.10.0-alpha.5 e iguales o superiores a 8.2.2 anteriores a 8.6.86 devuelven mensajes de error de validación de GraphQL que nombran campos de entrada personalizados obligatorios incluso cuando la introspección pública está deshabilitada (graphQLPublicIntrospection: false, el valor predeterminado). Un cliente que posee solo el ID de aplicación público - sin sesión de usuario, clave maestra o clave de mantenimiento - puede desencadenar errores de validación para conocer los nombres de los campos personalizados obligatorios (no nulos) en clases que ya referencia por nombre, lo que anula parcialmente la intención de ocultar el esquema al deshabilitar la introspección pública. No se exponen datos almacenados, credenciales, nombres de campos opcionales, nombres de clases no referenciadas o nombres de funciones de Cloud Code."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "parse-community",
          "product": "parse-server",
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/parse-server",
          "versions": [
            {
              "version": "9.0.0",
              "lessThan": "9.10.0-alpha.5",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "9.10.0-alpha.5",
              "versionType": "semver",
              "status": "unaffected"
            }
          ]
        },
        {
          "vendor": "parse-community",
          "product": "parse-server",
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/parse-server",
          "versions": [
            {
              "version": "8.2.2",
              "lessThan": "8.6.86",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "8.6.86",
              "versionType": "semver",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 6.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "LOW",
          "vulnIntegrityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-25T00:52:12.374484Z",
          "id": "CVE-2026-66009",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-209"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/parse-community/parse-server/security/advisories/GHSA-2fgh-8j2g-w354",
      "source": "[email protected]"
    },
    {
      "url": "https://www.vulncheck.com/advisories/parse-server-information-disclosure-via-graphql-error-messages-2",
      "source": "[email protected]"
    }
  ]
}