SEPTEMBER 7, 2026
Live Feed
Back to database
Case File

CVE-2026-64627

MEDIUM · CVSS 6.9 EPSS 0.28% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-07-21 · Last synced 2026-08-20

CyberRota Analysis

AI-Generated

Versions of Parse Server prior to 9.10.0-alpha.4 and 8.6.85 are vulnerable to a schema disclosure flaw in the GraphQL API, which allows unauthenticated users to extract sensitive schema information through error messages, even when public introspection is disabled. This vulnerability can lead to the exposure of registered Cloud Code function names and other critical identifiers, potentially facilitating further attacks. Organizations using affected Parse Server versions should prioritize updating to the fixed versions to mitigate this risk.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-64627
Severity
MEDIUM
CVSS
6.9
EPSS
0.28%

Original NVD Description

Parse Server versions >= 9.0.0 before 9.10.0-alpha.4 and versions before 8.6.85 contain a schema disclosure vulnerability. When the GraphQL API is mounted with public introspection disabled (graphQLPublicIntrospection: false, the default), schema-derived 'Did you mean ...?' suggestions were still returned in GraphQL error messages produced during variable coercion, which were not covered by the introspection-hardening control (that only handled validation errors). An unauthenticated caller possessing only the public application id can iteratively recover hidden schema identifiers — including registered Cloud Code function names and Parse class and field names — by submitting queries or mutations whose variables contain near-miss enum values or input-object field names. This is a follow-up bypass of GHSA-8cph-rgr4-g5vj. The issue is fixed in 9.10.0-alpha.4 and 8.6.85.