CVE-2026-66008

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-66008
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-66008.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-66008
Aliases
  • GHSA-r2g6-4f6j-f6rf
Published
2026-07-24T12:07:55.967Z
Modified
2026-07-25T04:14:50.625517475Z
Severity
  • 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages
Details

Parse Server versions >= 9.0.0 before 9.10.0-alpha.6 and >= 8.2.2 before 8.6.87 disclose Pointer and Relation target class names through GraphQL validation and input-coercion error messages when public schema introspection is disabled (graphQLPublicIntrospection: false, the default). Because these errors are produced before authentication, authorization, or any resolver runs, an unauthenticated client possessing only the public application ID can trigger errors on Pointer or Relation fields to reconstruct hidden schema class names, partially defeating the schema-hiding protection. Only schema metadata (class names) is exposed; no object data, credentials, or user records are disclosed.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/66xxx/CVE-2026-66008.json",
    "cwe_ids": [
        "CWE-209"
    ],
    "cna_assigner": "VulnCheck"
}
References

Affected packages

Git / github.com/parse-community/parse-server

Affected ranges

Type
GIT
Repo
https://github.com/parse-community/parse-server
Events
Introduced
532a461d30a6ed4457839f2caf5f30d5abf51a55
Fixed
348d90ed54263997af649fbcb9c4b1ffbb43fb68
Introduced
e3f5ae0be78361daffee9e8bde148906e9b878f9
Fixed
19611b7e93e999dc545b6f53ee444f3fa53d7596
Database specific 
{
    "extracted_events": [
        {
            "introduced": "9.0.0"
        },
        {
            "fixed": "9.10.0-alpha.6"
        },
        {
            "introduced": "8.2.2"
        },
        {
            "fixed": "8.6.87"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

8.*
8.2.2
8.2.3
8.2.4
8.2.5
8.3.0
8.4.0
8.5.0
8.6.0
8.6.1
8.6.10
8.6.11
8.6.12
8.6.13
8.6.14
8.6.15
8.6.16
8.6.17
8.6.18
8.6.19
8.6.2
8.6.20
8.6.21
8.6.22
8.6.23
8.6.24
8.6.25
8.6.26
8.6.27
8.6.28
8.6.29
8.6.3
8.6.30
8.6.31
8.6.32
8.6.33
8.6.34
8.6.35
8.6.36
8.6.37
8.6.38
8.6.39
8.6.4
8.6.40
8.6.41
8.6.42
8.6.43
8.6.44
8.6.45
8.6.46
8.6.47
8.6.48
8.6.49
8.6.5
8.6.50
8.6.51
8.6.52
8.6.53
8.6.54
8.6.55
8.6.56
8.6.57
8.6.58
8.6.59
8.6.6
8.6.60
8.6.61
8.6.62
8.6.63
8.6.64
8.6.65
8.6.66
8.6.67
8.6.68
8.6.69
8.6.7
8.6.70
8.6.71
8.6.72
8.6.73
8.6.74
8.6.75
8.6.76
8.6.77
8.6.78
8.6.79
8.6.8
8.6.80
8.6.81
8.6.82
8.6.83
8.6.84
8.6.85
8.6.86
8.6.9
9.*
9.0.0
9.1.0
9.1.1
9.10.0-alpha.1
9.10.0-alpha.2
9.10.0-alpha.3
9.10.0-alpha.4
9.10.0-alpha.5
9.2.0
9.3.0
9.3.1
9.4.0
9.4.1
9.5.0
9.5.1
9.6.0
9.6.1
9.7.0
9.8.0
9.9.0
9.9.1-alpha.1
9.9.1-alpha.10
9.9.1-alpha.11
9.9.1-alpha.12
9.9.1-alpha.13
9.9.1-alpha.2
9.9.1-alpha.3
9.9.1-alpha.4
9.9.1-alpha.5
9.9.1-alpha.6
9.9.1-alpha.7
9.9.1-alpha.8
9.9.1-alpha.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-66008.json"