PT-2026-23874 · Unknown+1 · Parse Server+1
Fancymalware
·
Published
2026-03-07
·
Updated
2026-03-11
·
CVE-2026-30854
CVSS v4.0
6.9
Medium
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Parse Server versions 9.3.1-alpha.3 through 9.5.0-alpha.10
Description
Parse Server, an open source backend deployable on Node.js infrastructures, contains an issue where disabling graphQLPublicIntrospection does not fully prevent unauthenticated users from performing type reconnaissance. Specifically,
type queries nested within inline fragments can bypass introspection controls. The schema introspection functionality remains unaffected. The issue occurs when graphQLPublicIntrospection is disabled and allows attackers to gather information about the server's schema. The vulnerable queries utilize the type function within inline fragments, such as ... on Query { type(name:"User") { name } }.Recommendations
Update to Parse Server version 9.5.0-alpha.10 or later.
Exploit
Fix
Incorrect Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Node.Js
Parse Server