Parse Server GraphQL Schema Disclosure via Validation Suggestions (CVE-2025-47248)

GraphQL "Did you mean" validation suggestions disclose schema to unauthenticated callers Vulnerability Overview The GraphQL endpoint in Parse Server leaks schema metadata to unauthenticated callers through suggestions. Attackers can exploit these suggestions to infer class names, field names, parameter names, mutation names, and input object fields. This bypasses the schema hiding goal enforced by the when (the default), but does not leak object data or authentication credentials. Affected Versions Affected versions: >= 9.0.0, < 9.9.1-alpha.2, < 8.6.78 Fixed versions: 9.9.1-alpha.2, 8.6.78 Remediation Patch: A new Apollo plugin strips the suffix from GraphQL validation error messages. This plugin is applied only when and the caller is not a holder of the master key or maintenance key, aligning with the trust model of the existing . Temporary Workaround: There is no code-based workaround available before the patch. Disclosure can be avoided by disabling the GraphQL API ( ). Operators requiring mitigation against leaking validation errors should upgrade to a patched release. References GitHub Security Advisory: GHSA-8cph-rgr4-g5jv Fix for Parse Server 9: #10467 Fix for Parse Server 8: #10468 CVSS v4 Base Metrics Severity: 6.9 / 10 Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Attack Requirements: None - Required Privileges: None - User Interaction: None Vulnerable System Impact Metrics: - Confidentiality: Low - Integrity: None - Availability: None Subsequent System Impact Metrics: - Confidentiality: None - Integrity: None - Availability: None CVE ID CVE-2025-47248 Weakness CWE-209 Credit @trefet (Reporter) mtrezza (Coordinator)

Goal Reached Thanks to every supporter — we hit 100%!

Parse Server GraphQL Schema Disclosure via Validation Suggestions (CVE-2025-47248)

More from this source