What’s Vulnerable › Vulnerabilities

CVE-2026-105828: Parse Server 9.0.0 before 9.10.1-alpha.12 Class Name Disclosure via GraphQL Errors

• Severity: medium (CVSS 6.3 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-08 · updated 2026-10-08
• Weakness: CWE-209

Description

Parse Server 8.2.2 before 8.6.92 and 9.0.0 before 9.10.1-alpha.12 contains an information disclosure vulnerability in which GraphQL validation error messages reveal hidden class names when public introspection is disabled. Unauthenticated attackers holding only the public Application Id can send crafted operations triggering unknown-argument or invalid enum value errors to learn pointer and relation target classes.

Affected products

• parse-community parse-server: from 9.0.0 before 9.10.1-alpha.12; from 8.2.2 before 8.6.92 — fixed in 8.6.92, 9.10.1-alpha.12

How to fix

Upgrade to a fixed version: parse-community parse-server 8.6.92, 9.10.1-alpha.12. Check the vendor advisory for mitigations.

References

• https://github.com/parse-community/parse-server/security/advisories/GHSA-6m77-f8xr-f723
• https://www.vulncheck.com/advisories/parse-server-9.0.0-before-9.10.1-alpha.12-class-name-disclosure-via-graphql-errors

Get alerted when CVE-2026-105828 or the next vulnerability affects your stack