SB2026091508 - Information Exposure Through an Error Message in Parse Server

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026091508

SB2026091508 - Information Exposure Through an Error Message in Parse Server

Published: September 15, 2026

Security Bulletin ID SB2026091508
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Information Exposure Through an Error Message (CVE-ID: CVE-2026-66009)

CWE-ID: CWE-209 - Information Exposure Through an Error Message

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose the names of required custom input fields.

The vulnerability exists due to generation of error messages containing sensitive information in GraphQL validation error messages when submitting GraphQL requests that omit required custom input fields. A remote attacker can submit a request that omits required custom input fields to disclose the names of required custom input fields.

Public introspection must be disabled. The disclosure is limited to required non-null custom field names on classes already referenced by name.


Remediation

Install update from vendor's website.

References