CVE-2026-66009 Details

A vulnerability exists in Parse Server versions 9.0.0 prior to 9.10.0-alpha.5 and versions 8.2.2 prior to 8.6.86. These versions return GraphQL validation error messages that inadvertently disclose the names of required custom input fields, even when public introspection is disabled. A client with only the public application ID, and no user session, master key, or maintenance key, can exploit this behavior. By triggering validation errors, the client can learn the names of required (non-null) custom fields on referenced classes, partially undermining the intended privacy of the schema. This vulnerability does not expose any stored data, credentials, optional field names, unreferenced class names, or Cloud Code function names.