Information Exposure Through an Error Message in Parse Server - CVE-2026-66009
Published: September 15, 2026
Vulnerability identifier: #VU149928
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-66009
CWE-ID: CWE-209
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose the names of required custom input fields.
The vulnerability exists due to generation of error messages containing sensitive information in GraphQL validation error messages when submitting GraphQL requests that omit required custom input fields. A remote attacker can submit a request that omits required custom input fields to disclose the names of required custom input fields.
Public introspection must be disabled. The disclosure is limited to required non-null custom field names on classes already referenced by name.
Affected software
Parse Server
How to mitigate CVE-2026-66009
Install security update from vendor's website.
Parse Server - addressed in versions 8.6.86, 9.10.0 alpha.5