CVE-2026-64627

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-64627", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-07-20T11:58:54.524Z", "datePublished": "2026-07-21T11:39:55.087Z", "dateUpdated": "2026-07-28T01:05:56.657Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-07-28T01:05:56.657Z"}, "datePublic": "2026-07-08T00:00:00.000Z", "title": "Parse Server 9.0.0 Schema Disclosure via GraphQL Variable Coercion", "descriptions": [{"lang": "en", "value": "Parse Server versions >= 9.0.0 before 9.10.0-alpha.4 and versions before 8.6.85 contain a schema disclosure vulnerability. When the GraphQL API is mounted with public introspection disabled (graphQLPublicIntrospection: false, the default), schema-derived 'Did you mean ...?' suggestions were still returned in GraphQL error messages produced during variable coercion, which were not covered by the introspection-hardening control (that only handled validation errors). An unauthenticated caller possessing only the public application id can iteratively recover hidden schema identifiers \u2014 including registered Cloud Code function names and Parse class and field names \u2014 by submitting queries or mutations whose variables contain near-miss enum values or input-object field names. This is a follow-up bypass of GHSA-8cph-rgr4-g5vj. The issue is fixed in 9.10.0-alpha.4 and 8.6.85."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Generation of Error Message Containing Sensitive Information", "cweId": "CWE-209", "type": "CWE"}]}], "affected": [{"vendor": "parse-community", "product": "parse-server", "defaultStatus": "unaffected", "packageURL": "pkg:npm/parse-server", "versions": [{"version": "9.0.0", "status": "affected", "versionType": "semver", "lessThan": "9.10.0-alpha.4"}, {"version": "9.10.0-alpha.4", "status": "unaffected", "versionType": "semver"}]}, {"vendor": "parse-community", "product": "parse-server", "defaultStatus": "unaffected", "packageURL": "pkg:npm/parse-server", "versions": [{"version": "0", "status": "affected", "versionType": "semver", "lessThan": "8.6.85"}, {"version": "8.6.85", "status": "unaffected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*", "versionStartIncluding": "9.0.0", "versionEndExcluding": "9.10.0-alpha.4"}, {"vulnerable": true, "criteria": "cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*", "versionEndExcluding": "8.6.85"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.9, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://github.com/parse-community/parse-server/security/advisories/GHSA-9g8f-h8f3-hjcm", "name": "GitHub Security Advisory (GHSA-9g8f-h8f3-hjcm)", "tags": ["vendor-advisory"]}, {"name": "VulnCheck Advisory: Parse Server 9.0.0 Schema Disclosure via GraphQL Variable Coercion", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/parse-server-schema-disclosure-via-graphql-variable-coercion"}], "credits": [{"lang": "en", "value": "offset", "type": "reporter"}, {"lang": "en", "value": "mtrezza", "type": "coordinator"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-21T13:11:04.531501Z", "id": "CVE-2026-64627", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-21T14:55:23.663Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-64627", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-21T13:11:04.531501Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-21T13:11:08.231Z"}}], "cna": {"title": "Parse Server 9.0.0 Schema Disclosure via GraphQL Variable Coercion", "credits": [{"lang": "en", "type": "reporter", "value": "offset"}, {"lang": "en", "type": "coordinator", "value": "mtrezza"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 6.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW"}}], "affected": [{"vendor": "parse-community", "product": "parse-server", "versions": [{"status": "affected", "version": "9.0.0", "lessThan": "9.10.0-alpha.4", "versionType": "semver"}, {"status": "unaffected", "version": "9.10.0-alpha.4", "versionType": "semver"}], "packageURL": "pkg:npm/parse-server", "defaultStatus": "unaffected"}, {"vendor": "parse-community", "product": "parse-server", "versions": [{"status": "affected", "version": "0", "lessThan": "8.6.85", "versionType": "semver"}, {"status": "unaffected", "version": "8.6.85", "versionType": "semver"}], "packageURL": "pkg:npm/parse-server", "defaultStatus": "unaffected"}], "datePublic": "2026-07-08T00:00:00.000Z", "references": [{"url": "https://github.com/parse-community/parse-server/security/advisories/GHSA-9g8f-h8f3-hjcm", "name": "GitHub Security Advisory (GHSA-9g8f-h8f3-hjcm)", "tags": ["vendor-advisory"]}, {"url": "https://www.vulncheck.com/advisories/parse-server-schema-disclosure-via-graphql-variable-coercion", "name": "VulnCheck Advisory: Parse Server 9.0.0 Schema Disclosure via GraphQL Variable Coercion", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "Parse Server versions >= 9.0.0 before 9.10.0-alpha.4 and versions before 8.6.85 contain a schema disclosure vulnerability. When the GraphQL API is mounted with public introspection disabled (graphQLPublicIntrospection: false, the default), schema-derived 'Did you mean ...?' suggestions were still returned in GraphQL error messages produced during variable coercion, which were not covered by the introspection-hardening control (that only handled validation errors). An unauthenticated caller possessing only the public application id can iteratively recover hidden schema identifiers \u2014 including registered Cloud Code function names and Parse class and field names \u2014 by submitting queries or mutations whose variables contain near-miss enum values or input-object field names. This is a follow-up bypass of GHSA-8cph-rgr4-g5vj. The issue is fixed in 9.10.0-alpha.4 and 8.6.85."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-209", "description": "Generation of Error Message Containing Sensitive Information"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*", "vulnerable": true, "versionEndExcluding": "9.10.0-alpha.4", "versionStartIncluding": "9.0.0"}, {"criteria": "cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*", "vulnerable": true, "versionEndExcluding": "8.6.85"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-07-28T01:05:56.657Z"}}}, "cveMetadata": {"cveId": "CVE-2026-64627", "state": "PUBLISHED", "dateUpdated": "2026-07-28T01:05:56.657Z", "dateReserved": "2026-07-20T11:58:54.524Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-07-21T11:39:55.087Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:npm/parse-server", "product": "parse-server", "vendor": "parse-community", "versions": [{"lessThan": "9.10.0-alpha.4", "status": "affected", "version": "9.0.0", "versionType": "semver"}, {"status": "unaffected", "version": "9.10.0-alpha.4", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "packageURL": "pkg:npm/parse-server", "product": "parse-server", "vendor": "parse-community", "versions": [{"lessThan": "8.6.85", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "8.6.85", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Parse Server versions >= 9.0.0 before 9.10.0-alpha.4 and versions before 8.6.85 contain a schema disclosure vulnerability. When the GraphQL API is mounted with public introspection disabled (graphQLPublicIntrospection: false, the default), schema-derived 'Did you mean ...?' suggestions were still returned in GraphQL error messages produced during variable coercion, which were not covered by the introspection-hardening control (that only handled validation errors). An unauthenticated caller possessing only the public application id can iteratively recover hidden schema identifiers \u2014 including registered Cloud Code function names and Parse class and field names \u2014 by submitting queries or mutations whose variables contain near-miss enum values or input-object field names. This is a follow-up bypass of GHSA-8cph-rgr4-g5vj. The issue is fixed in 9.10.0-alpha.4 and 8.6.85."}, {"lang": "es", "value": "Las versiones de Parse Server >= 9.0.0 anteriores a 9.10.0-alpha.4 y las versiones anteriores a 8.6.85 contienen una vulnerabilidad de divulgaci\u00f3n de esquema. Cuando la API de GraphQL est\u00e1 montada con la introspecci\u00f3n p\u00fablica deshabilitada (graphQLPublicIntrospection: false, el valor predeterminado), las sugerencias derivadas del esquema \u2019\u00bfQuiso decir...?\u2019 a\u00fan se devolv\u00edan en los mensajes de error de GraphQL producidos durante la coerci\u00f3n de variables, las cuales no estaban cubiertas por el control de endurecimiento de la introspecci\u00f3n (que solo manejaba errores de validaci\u00f3n). Un llamador no autenticado que posee solo el ID de aplicaci\u00f3n p\u00fablico puede recuperar iterativamente identificadores de esquema ocultos - incluyendo nombres de funciones de Cloud Code registradas y nombres de clases y campos de Parse - al enviar consultas o mutaciones cuyas variables contienen valores de enumeraci\u00f3n casi coincidentes o nombres de campos de objetos de entrada. Esto es un bypass de seguimiento de GHSA-8cph-rgr4-g5vj. El problema est\u00e1 solucionado en 9.10.0-alpha.4 y 8.6.85."}], "id": "CVE-2026-64627", "lastModified": "2026-10-24T20:10:00.137", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-64627", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-21T13:11:04.531501Z", "version": "2.0.3"}}]}, "published": "2026-07-21T12:19:00.450", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/parse-community/parse-server/security/advisories/GHSA-9g8f-h8f3-hjcm"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/parse-server-schema-disclosure-via-graphql-variable-coercion"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-209"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[9.0.0,9.10.0-alpha.4)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "9.10.0-alpha.4"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "parse-server", "source": "cna", "vendor": "parse-community"}, "product": "parse_server", "vendor": "parse_community"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,8.6.85)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "8.6.85"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "parse-server", "source": "cna", "vendor": "parse-community"}, "product": "parse_server", "vendor": "parse_community"}], "created": "2026-07-21T23:30:03.880769+00:00", "updated": "2026-07-30T18:00:15.750260+00:00", "vendors": ["parse_community", "parse_community$PRODUCT$parse_server"]}