CVE-2026-66008 Details

A vulnerability exists in Parse Server versions 9.0.0 prior to 9.10.0-alpha.6 and versions 8.2.2 prior to 8.6.87. These versions disclose Pointer and Relation target class names through GraphQL validation and input-coercion error messages. This occurs when public schema introspection is disabled, which is the default setting. The error messages, generated before authentication or authorization processes, allow an unauthenticated client with only the public application ID to access hidden schema class names by triggering errors on Pointer or Relation fields. While this partially undermines the schema-hiding feature, it is important to note that only class names are exposed, without any object data, credentials, or user records.