PT-2026-45045 · Unknown · Parse Server
CVE-2026-47248
·
Published
2026-05-29
·
Updated
2026-06-16
CVSS v4.0
6.9
Medium
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Parse Server versions prior to 8.6.78
Parse Server versions prior to 9.9.1-alpha.2
Description
The GraphQL endpoint discloses schema metadata to unauthenticated callers via "Did you mean ...?" suggestions within GraphQL validation-error messages. An unauthenticated user possessing only the public application id can send iterative malformed queries to reconstruct mutation names, input-object fields, class names, field names, and argument names. This behavior bypasses the
IntrospectionControlPlugin used when graphQLPublicIntrospection is set to false, undermining efforts to hide the schema. While this does not directly leak authentication material or object data, it facilitates reconnaissance for authorization probing.Recommendations
Update to version 8.6.78 or later.
Update to version 9.9.1-alpha.2 or later.
As a temporary workaround, disable the GraphQL API by setting
mountGraphQL to false.Exploit
Fix
Generation of Error Message Containing Sensitive Information
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Parse Server