CVE-2026-105828
Parse Server 8.2.2 before 8.6.92 and 9.0.0 before 9.10.1-alpha.12 contains an information…
- Risk score
- 43/100
- CVSS
- 6.3 v4.0
- Exploit chance (30 days)
- 0.3%
- Published
- 8 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Parse Server 8.2.2 before 8.6.92 and 9.0.0 before 9.10.1-alpha.12 contains an information disclosure vulnerability in which GraphQL validation error messages reveal hidden class names when public introspection is disabled. Unauthenticated attackers holding only the public Application Id can send crafted operations tri…
- Affected
- See advisory
- Fix
- Upgrade the product to 8.6.92, 9.0.0 or 9.10.1 (whichever matches your release line), or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 6.3 medium
References
Original description
Parse Server 8.2.2 before 8.6.92 and 9.0.0 before 9.10.1-alpha.12 contains an information disclosure vulnerability in which GraphQL validation error messages reveal hidden class names when public introspection is disabled. Unauthenticated attackers holding only the public Application Id can send crafted operations triggering unknown-argument or invalid enum value errors to learn pointer and relation target classes.
Last activity 8 Oct 2026. Patch Forecast updates every hour.