CVE-2026-47248 Parse Server: GraphQL "Did you mean" validation suggestions disclose schema to unauthenticated callers

🗓️ 12 Jun 2026 18:21:31Reported by GitHub_MType

Parse Server GraphQL did you mean exposes unauthenticated schema; fixed in eight-six-seven-eight and nine-nine-one-alpha-two.

Reporter	Title	Published	Views	Family All 11
CVE	CVE-2026-47248	12 Jun 202618:21	–	cve
EUVD	EUVD-2026-36534	12 Jun 202618:21	–	euvd
Github Security Blog	Parse Server's GraphQL "Did you mean ...?" validation suggestions disclose schema to unauthenticated callers	29 May 202619:18	–	github
NVD	CVE-2026-47248	12 Jun 202619:16	–	nvd
OSV	GHSA-8CPH-RGR4-G5VJ Parse Server's GraphQL "Did you mean ...?" validation suggestions disclose schema to unauthenticated callers	29 May 202619:18	–	osv
Positive Technologies	PT-2026-45045	29 May 202600:00	–	ptsecurity
Snyk	Information Exposure	29 May 202619:18	–	snyk
vulnersOsv	@openinc/parse-server-opendash (>=3.31.25 <=4.0.34) potentially affected by CVE-2026-47248 via parse-server (>=9.6.0-alpha.37 <=9.9.0)	29 May 202619:18	–	vulnersosv
vulnersOsv	@bigegg/parse-server-schema-config (>=1.0.5 <=1.0.10), @kontaa/subgraph (>=1.0.1 <=1.2.3) +27 more potentially affected by CVE-2026-47248 via parse-server (>=2.0.8 <=7.5.4)	29 May 202619:18	–	vulnersosv
vulnersOsv	@openinc/parse-server-opendash (>=3.31.25 <=4.0.34) potentially affected by CVE-2026-47248 via parse-server (>=9.6.0-alpha.37 <=9.9.0)	29 May 202619:18	–	vulnersosv

[
  {
    "vendor": "parse-community",
    "product": "parse-server",
    "versions": [
      {
        "version": "< 8.6.78",
        "status": "affected"
      },
      {
        "version": ">= 9.0.0, < 9.9.1-alpha.2",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/parse-community/parse-server/security/advisories/GHSA-8cph-rgr4-g5vj
github	www.github.com/parse-community/parse-server/pull/10467
github	www.github.com/parse-community/parse-server/pull/10468

12 Jun 2026 18:21Current

CVSS 46.9

EPSS0.00105

CWE-209