CVE-2026-66009

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-66009", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-07-23T19:22:30.643Z", "datePublished": "2026-07-24T12:07:56.720Z", "dateUpdated": "2026-07-28T01:06:21.175Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-07-28T01:06:21.175Z"}, "datePublic": "2026-07-10T00:00:00.000Z", "title": "Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages", "descriptions": [{"lang": "en", "value": "Parse Server versions >= 9.0.0 before 9.10.0-alpha.5 and >= 8.2.2 before 8.6.86 return GraphQL validation error messages that name required custom input fields even when public introspection is disabled (graphQLPublicIntrospection: false, the default). A client holding only the public application id \u2014 with no user session, master key, or maintenance key \u2014 can trigger validation errors to learn the names of required (non-null) custom fields on classes it already references by name, partially defeating the schema-hiding intent of disabling public introspection. No stored data, credentials, optional field names, unreferenced class names, or Cloud Code function names are exposed."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Generation of Error Message Containing Sensitive Information", "cweId": "CWE-209", "type": "CWE"}]}], "affected": [{"vendor": "parse-community", "product": "parse-server", "defaultStatus": "unaffected", "packageURL": "pkg:npm/parse-server", "versions": [{"version": "9.0.0", "status": "affected", "versionType": "semver", "lessThan": "9.10.0-alpha.5"}, {"version": "9.10.0-alpha.5", "status": "unaffected", "versionType": "semver"}]}, {"vendor": "parse-community", "product": "parse-server", "defaultStatus": "unaffected", "packageURL": "pkg:npm/parse-server", "versions": [{"version": "8.2.2", "status": "affected", "versionType": "semver", "lessThan": "8.6.86"}, {"version": "8.6.86", "status": "unaffected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*", "versionStartIncluding": "9.0.0", "versionEndExcluding": "9.10.0-alpha.5"}, {"vulnerable": true, "criteria": "cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*", "versionStartIncluding": "8.2.2", "versionEndExcluding": "8.6.86"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.3, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://github.com/parse-community/parse-server/security/advisories/GHSA-2fgh-8j2g-w354", "name": "GitHub Security Advisory (GHSA-2fgh-8j2g-w354)", "tags": ["vendor-advisory"]}, {"name": "VulnCheck Advisory: Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/parse-server-information-disclosure-via-graphql-error-messages-2"}], "credits": [{"lang": "en", "value": "mtrezza", "type": "coordinator"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-25T00:52:12.374484Z", "id": "CVE-2026-66009", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-25T00:52:22.059Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-66009", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-25T00:52:12.374484Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-25T00:52:17.721Z"}}], "cna": {"title": "Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages", "credits": [{"lang": "en", "type": "coordinator", "value": "mtrezza"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW"}}], "affected": [{"vendor": "parse-community", "product": "parse-server", "versions": [{"status": "affected", "version": "9.0.0", "lessThan": "9.10.0-alpha.5", "versionType": "semver"}, {"status": "unaffected", "version": "9.10.0-alpha.5", "versionType": "semver"}], "packageURL": "pkg:npm/parse-server", "defaultStatus": "unaffected"}, {"vendor": "parse-community", "product": "parse-server", "versions": [{"status": "affected", "version": "8.2.2", "lessThan": "8.6.86", "versionType": "semver"}, {"status": "unaffected", "version": "8.6.86", "versionType": "semver"}], "packageURL": "pkg:npm/parse-server", "defaultStatus": "unaffected"}], "datePublic": "2026-07-10T00:00:00.000Z", "references": [{"url": "https://github.com/parse-community/parse-server/security/advisories/GHSA-2fgh-8j2g-w354", "name": "GitHub Security Advisory (GHSA-2fgh-8j2g-w354)", "tags": ["vendor-advisory"]}, {"url": "https://www.vulncheck.com/advisories/parse-server-information-disclosure-via-graphql-error-messages-2", "name": "VulnCheck Advisory: Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "Parse Server versions >= 9.0.0 before 9.10.0-alpha.5 and >= 8.2.2 before 8.6.86 return GraphQL validation error messages that name required custom input fields even when public introspection is disabled (graphQLPublicIntrospection: false, the default). A client holding only the public application id \u2014 with no user session, master key, or maintenance key \u2014 can trigger validation errors to learn the names of required (non-null) custom fields on classes it already references by name, partially defeating the schema-hiding intent of disabling public introspection. No stored data, credentials, optional field names, unreferenced class names, or Cloud Code function names are exposed."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-209", "description": "Generation of Error Message Containing Sensitive Information"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*", "vulnerable": true, "versionEndExcluding": "9.10.0-alpha.5", "versionStartIncluding": "9.0.0"}, {"criteria": "cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*", "vulnerable": true, "versionEndExcluding": "8.6.86", "versionStartIncluding": "8.2.2"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-07-28T01:06:21.175Z"}}}, "cveMetadata": {"cveId": "CVE-2026-66009", "state": "PUBLISHED", "dateUpdated": "2026-07-28T01:06:21.175Z", "dateReserved": "2026-07-23T19:22:30.643Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-07-24T12:07:56.720Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:npm/parse-server", "product": "parse-server", "vendor": "parse-community", "versions": [{"lessThan": "9.10.0-alpha.5", "status": "affected", "version": "9.0.0", "versionType": "semver"}, {"status": "unaffected", "version": "9.10.0-alpha.5", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "packageURL": "pkg:npm/parse-server", "product": "parse-server", "vendor": "parse-community", "versions": [{"lessThan": "8.6.86", "status": "affected", "version": "8.2.2", "versionType": "semver"}, {"status": "unaffected", "version": "8.6.86", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Parse Server versions >= 9.0.0 before 9.10.0-alpha.5 and >= 8.2.2 before 8.6.86 return GraphQL validation error messages that name required custom input fields even when public introspection is disabled (graphQLPublicIntrospection: false, the default). A client holding only the public application id \u2014 with no user session, master key, or maintenance key \u2014 can trigger validation errors to learn the names of required (non-null) custom fields on classes it already references by name, partially defeating the schema-hiding intent of disabling public introspection. No stored data, credentials, optional field names, unreferenced class names, or Cloud Code function names are exposed."}, {"lang": "es", "value": "Las versiones de Parse Server iguales o superiores a 9.0.0 anteriores a 9.10.0-alpha.5 e iguales o superiores a 8.2.2 anteriores a 8.6.86 devuelven mensajes de error de validaci\u00f3n de GraphQL que nombran campos de entrada personalizados obligatorios incluso cuando la introspecci\u00f3n p\u00fablica est\u00e1 deshabilitada (graphQLPublicIntrospection: false, el valor predeterminado). Un cliente que posee solo el ID de aplicaci\u00f3n p\u00fablico - sin sesi\u00f3n de usuario, clave maestra o clave de mantenimiento - puede desencadenar errores de validaci\u00f3n para conocer los nombres de los campos personalizados obligatorios (no nulos) en clases que ya referencia por nombre, lo que anula parcialmente la intenci\u00f3n de ocultar el esquema al deshabilitar la introspecci\u00f3n p\u00fablica. No se exponen datos almacenados, credenciales, nombres de campos opcionales, nombres de clases no referenciadas o nombres de funciones de Cloud Code."}], "id": "CVE-2026-66009", "lastModified": "2026-10-24T13:10:00.147", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-66009", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-25T00:52:12.374484Z", "version": "2.0.3"}}]}, "published": "2026-07-24T13:18:28.580", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/parse-community/parse-server/security/advisories/GHSA-2fgh-8j2g-w354"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/parse-server-information-disclosure-via-graphql-error-messages-2"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-209"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[9.0.0,9.10.0-alpha.5)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "9.10.0-alpha.5"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "parse-server", "source": "cna", "vendor": "parse-community"}, "product": "parse_server", "vendor": "parse_community"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.2.2,8.6.86)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "8.6.86"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "parse-server", "source": "cna", "vendor": "parse-community"}, "product": "parse_server", "vendor": "parse_community"}], "created": "2026-07-24T22:45:17.098984+00:00", "updated": "2026-08-03T20:30:04.555497+00:00", "vendors": ["parse_community", "parse_community$PRODUCT$parse_server"]}