CVE-2026-66009: Parse-Community Parse-Server

Medium severity, CVSS 6.3. EPSS: 0.4% chance of exploitation in the next 30 days.

Parse Server versions >= 9.0.0 before 9.10.0-alpha.5 and >= 8.2.2 before 8.6.86 return GraphQL validation error messages that name required custom input fields even when public introspection is disabled (graphQLPublicIntrospection: false, the default). A client holding only the public application id — with no user session, master key, or maintenance key — can trigger validation errors to learn the names of required (non-null) custom fields on classes it already references by name, partially defeating the schema-hiding intent of disabling public introspection. No stored data, credentials, optional field names, unreferenced class names, or Cloud Code function names are exposed.

Affected products

• Parse-Community Parse-Server: from 9.0.0, before 9.10.0-alpha.5 (fixed in 9.10.0-alpha.5); from 8.2.2, before 8.6.86 (fixed in 8.6.86)

Published 2026-07-24. Last modified 2026-07-30.