CVE-2025-53364

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-53364
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-53364.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-53364
Aliases
Published
2025-07-10T15:18:24.855Z
Modified
2026-04-10T05:30:48.436916Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Parse Server exposes the data schema via GraphQL API
Details

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Starting in 5.3.0 and before 7.5.3 and 8.2.2, the Parse Server GraphQL API previously allowed public access to the GraphQL schema without requiring a session token or the master key. While schema introspection reveals only metadata and not actual data, this metadata can still expand the potential attack surface. This vulnerability is fixed in 7.5.3 and 8.2.2.

Database specific 
{
    "cwe_ids": [
        "CWE-497"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53364.json"
}
References

Affected packages

Git / github.com/parse-community/parse-server

Affected ranges

Type
GIT
Repo
https://github.com/parse-community/parse-server
Events
Introduced
12e174bcb6ef22afc038e89b09f78d3888512ffc
Fixed
6096449cf622190aadd1cd6c08a2328c2f75327d
Database specific 
{
    "versions": [
        {
            "introduced": "5.3.0"
        },
        {
            "fixed": "7.5.3"
        }
    ]
}
Type
GIT
Repo
https://github.com/parse-community/parse-server
Events
Introduced
3cb3c5f7c628ed5f0598cd33df4abcc612862b98
Fixed
e3f5ae0be78361daffee9e8bde148906e9b878f9
Database specific 
{
    "versions": [
        {
            "introduced": "8.0.0"
        },
        {
            "fixed": "8.2.2"
        }
    ]
}

Affected versions

5.*
5.3.0
5.3.1
5.3.2
5.3.3
5.4.0
6.*
6.0.0
6.1.0
6.2.0
6.2.1
6.2.2
6.3.0
6.3.1
6.4.0
7.*
7.0.0
7.1.0
7.2.0
7.3.0
7.4.0
7.5.0
7.5.1
7.5.2
8.*
8.0.0
8.0.1
8.0.2
8.1.0
8.2.0
8.2.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-53364.json"