CVE-2026-66009

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-66009
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-66009.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-66009
Aliases
  • GHSA-2fgh-8j2g-w354
Published
2026-07-24T12:07:56.720Z
Modified
2026-08-12T03:51:39.022140982Z
Severity
  • 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages
Details

Parse Server versions >= 9.0.0 before 9.10.0-alpha.5 and >= 8.2.2 before 8.6.86 return GraphQL validation error messages that name required custom input fields even when public introspection is disabled (graphQLPublicIntrospection: false, the default). A client holding only the public application id — with no user session, master key, or maintenance key — can trigger validation errors to learn the names of required (non-null) custom fields on classes it already references by name, partially defeating the schema-hiding intent of disabling public introspection. No stored data, credentials, optional field names, unreferenced class names, or Cloud Code function names are exposed.

Database specific 
{
    "cwe_ids": [
        "CWE-209"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/66xxx/CVE-2026-66009.json",
    "cna_assigner": "VulnCheck"
}
References

Affected packages

Git / github.com/parse-community/parse-server

Affected ranges

Type
GIT
Repo
https://github.com/parse-community/parse-server
Events
Introduced
532a461d30a6ed4457839f2caf5f30d5abf51a55
Fixed
3fa545f5901a84240ae05505a8688d468122b7a9
Introduced
e3f5ae0be78361daffee9e8bde148906e9b878f9
Fixed
c14da8141b60ebba71ffe709f1d927835ee971f5
Database specific
Show details 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "9.0.0"
        },
        {
            "fixed": "9.10.0-alpha.5"
        },
        {
            "introduced": "8.2.2"
        },
        {
            "fixed": "8.6.86"
        }
    ]
}

Affected versions

8.*
8.2.2
8.2.3
8.2.4
8.2.5
8.3.0
8.4.0
8.5.0
8.6.0
8.6.1
8.6.10
8.6.11
8.6.12
8.6.13
8.6.14
8.6.15
8.6.16
8.6.17
8.6.18
8.6.19
8.6.2
8.6.20
8.6.21
8.6.22
8.6.23
8.6.24
8.6.25
8.6.26
8.6.27
8.6.28
8.6.29
8.6.3
8.6.30
8.6.31
8.6.32
8.6.33
8.6.34
8.6.35
8.6.36
8.6.37
8.6.38
8.6.39
8.6.4
8.6.40
8.6.41
8.6.42
8.6.43
8.6.44
8.6.45
8.6.46
8.6.47
8.6.48
8.6.49
8.6.5
8.6.50
8.6.51
8.6.52
8.6.53
8.6.54
8.6.55
8.6.56
8.6.57
8.6.58
8.6.59
8.6.6
8.6.60
8.6.61
8.6.62
8.6.63
8.6.64
8.6.65
8.6.66
8.6.67
8.6.68
8.6.69
8.6.7
8.6.70
8.6.71
8.6.72
8.6.73
8.6.74
8.6.75
8.6.76
8.6.77
8.6.78
8.6.79
8.6.8
8.6.80
8.6.81
8.6.82
8.6.83
8.6.84
8.6.85
8.6.9
9.*
9.0.0
9.1.0
9.1.1
9.10.0-alpha.1
9.10.0-alpha.2
9.10.0-alpha.3
9.10.0-alpha.4
9.2.0
9.3.0
9.3.1
9.4.0
9.4.1
9.5.0
9.5.1
9.6.0
9.6.1
9.7.0
9.8.0
9.9.0
9.9.1-alpha.1
9.9.1-alpha.10
9.9.1-alpha.11
9.9.1-alpha.12
9.9.1-alpha.13
9.9.1-alpha.2
9.9.1-alpha.3
9.9.1-alpha.4
9.9.1-alpha.5
9.9.1-alpha.6
9.9.1-alpha.7
9.9.1-alpha.8
9.9.1-alpha.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-66009.json"