Parse Server GraphQL Public Introspection Disabled Info Disclosure Vulnerability

Vulnerability Overview Title: GraphQL error messages disclose required input field names when public introspection is disabled Description: When a GraphQL API is mounted with public introspection disabled ( , the default value), the GraphQL validation error messages returned by Parse Server include the names of required custom input fields that were not provided by the caller. Attackers possessing the public application ID but lacking a user session, master key, or maintenance key can learn the names of required fields by referencing fields on a class, partially undermining the intent of schema hiding when public introspection is disabled. Affected Versions Affected Versions: - >= 9.0.0, = 8.2.2, < 8.6.86 Fixed Versions: - 9.10.0-alpha.5 - 8.6.86 Severity: 6.3 / 10 CVSS v4 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Attack Requirements: Present - Privileges Required: None - User Interaction: None - Confidentiality: Low - Integrity: None - Availability: None Remediation Patch: Parse Server now obfuscates schema identifiers in affected GraphQL validation error messages for callers who do not allow introspection schemas (i.e., non-master-key and non-maintenance-key callers) when public introspection is disabled. The messages remain unchanged for master-key and maintenance-key callers, as well as for deployments with public introspection enabled, thereby preserving legitimate debug feedback where schema visibility is already permitted. Workaround: There is no configuration option to completely prevent disclosure without upgrading; upgrading to the patched version is recommended. Operators unable to upgrade immediately can restrict access to the GraphQL endpoint (e.g., to trusted networks or authenticated clients only) to limit exposure. References GitHub Security Advisory: GHSA-2fgh-82gj-w3s4 Fix for Parse Server 9: #10566 Fix for Parse Server 8: #10567 Additional Information CVE ID: Unknown CVE Weakness: CWE-209 Credit: mtrezza

Goal Reached Thanks to every supporter — we hit 100%!

Parse Server GraphQL Public Introspection Disabled Info Disclosure Vulnerability

More from this source