CVE-2026-47248 Details
Description
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.78 and 9.9.1-alpha.2, Parse Server's GraphQL endpoint discloses schema metadata to unauthenticated callers through Did you mean ...? suggestions embedded in GraphQL validation-error messages. An unauthenticated caller who knows only the public application id can iteratively send malformed queries to reconstruct class names, field names, argument names, mutation names, and input-object fields. This issue has been patched in versions 8.6.78 and 9.9.1-alpha.2.
A vulnerability in Parse Server's GraphQL endpoint allows unauthenticated users to access schema metadata. This issue is present in versions prior to 8.6.78 and 9.9.1-alpha.2. The vulnerability arises because the GraphQL validation-error messages include 'Did you mean ...?' suggestions, which can be exploited by sending malformed queries. An unauthenticated caller who knows the public application ID can iteratively reconstruct class names, field names, argument names, mutation names, and input-object fields. This vulnerability bypasses the 'IntrospectionControlPlugin' when 'graphQLPublicIntrospection' is set to false, the default setting, and undermines the schema-hiding objectives of previous advisories.
Users should upgrade to Parse Server versions 8.6.78 or 9.9.1-alpha.2. For those using version 9, the 'SchemaSuggestionsControlPlugin' Apollo plugin can be applied to remove the 'Did you mean ...?' suffix from validation-error messages, ensuring compatibility with the existing 'IntrospectionControlPlugin'.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 12, 2026CISA-ADP
Assessed Jun 12, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/parse-community/parse-server/pull/10467 | [email protected] | Issue TrackingVendor |
| https://github.com/parse-community/parse-server/pull/10468 | [email protected] | Issue TrackingVendor |
| https://github.com/parse-community/parse-server/security/advisories/GHSA-8cph-rgr4-g5vj | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-209 | Generation of Error Message Containing Sensitive Information | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Parse Server | >= 9.0.0, < 9.9.1-alpha.2 (semver) < 8.6.78 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 12, 2026 | New CVE Received | [email protected] |