All vulnerabilities
CVE-2026-109302GHSA-gxxq-pghq-9vrc

parse-server: Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 GraphQL Schema Disclosure via Persisted Queries

parse-community parse-server
Open in ThreatlineRecord JSON
CVSS
6.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.22%Chance of exploitation activity in the next 30 days, higher than 12% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in9.10.1-alpha.14Also 8.6.94CVE List
Published12 Oct 2026Updated 15 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 applies its GraphQL introspection control only to operation text sent directly with a request, not to operations resolved from Apollo Server's automatic persisted query cache. Unauthenticated attackers holding the public Application Id and client key can replay an introspection query previously cached by a master or maintenance key client to retrieve the schema, including private class and field names.

Text from CVE List

Affected versions 4

  • parse-serveraffected: 9.0.0 before 9.10.1-alpha.14CVE List
  • parse-serverunaffected: 9.10.1-alpha.14CVE List
  • parse-serveraffected: 8.2.2 before 8.6.94CVE List
  • parse-serverunaffected: 8.6.94CVE List

References 2