EUVD-2026-48581

Parse Server versions = 9.0.0 before 9.10.0-alpha.5 and = 8.2.2 before 8.6.86 return GraphQL validation error messages that name required custom input fields even when public introspection is disabled graphQLPublicIntrospection: false, the default. A client holding only the public application id ...

CVE-2026-66008

Parse Server versions >= 9.0.0 before 9.10.0-alpha.6 and >= 8.2.2 before 8.6.87 expose Pointer and Relation target class names through GraphQL validation and input-coercion error messages when public schema introspection is disabled (graphQLPublicIntrospection: false). Since errors are prod...

CVE-2026-64627

Parse Server versions 9.0.0–8.6.84/9.0.0–9.10.0-alpha.3 contain a schema disclosure vulnerability where, when GraphQL public introspection is disabled, error messages during variable coercion reveal hidden schema identifiers (e.g., Cloud Code function names, Parse class/field names) to an unauthe...