6.3Mittel
CVE-2026-105828Parse Server 9.0.0 before 9.10.1-alpha.12 Class Name Disclosure via GraphQL Errors
Beschreibung
Parse Server 8.2.2 before 8.6.92 and 9.0.0 before 9.10.1-alpha.12 contains an information disclosure vulnerability in which GraphQL validation error messages reveal hidden class names when public introspection is disabled. Unauthenticated attackers holding only the public Application Id can send crafted operations triggering unknown-argument or invalid enum value errors to learn pointer and relation target classes.
Schwachstellentyp (CWE):
CWE-209
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| parse-community | parse-server | 9.0.0 – < 9.10.1-alpha.12, fixed 9.10.1-alpha.12 | |
| parseplatform | parse-server | 9.0.0 – < 9.10.1-alpha.12 |
Referenzen und Patches
- GitHub Security Advisory (GHSA-6m77-f8xr-f723) vendor-advisory
- VulnCheck Advisory: Parse Server 9.0.0 before 9.10.1-alpha.12 Class Name Disclosure via GraphQL Errors third-party-advisory