CyberRota Analysis
AI-GeneratedParse Server versions prior to 9.10.0-alpha.6 and 8.6.87 are vulnerable to information disclosure, allowing unauthenticated clients to exploit GraphQL validation errors to reveal hidden Pointer and Relation class names when public schema introspection is disabled. This vulnerability undermines schema-hiding protections, potentially aiding attackers in understanding the application's data structure. Organizations using affected versions should prioritize remediation to prevent potential exploitation of this information.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Parse Server versions >= 9.0.0 before 9.10.0-alpha.6 and >= 8.2.2 before 8.6.87 disclose Pointer and Relation target class names through GraphQL validation and input-coercion error messages when public schema introspection is disabled (graphQLPublicIntrospection: false, the default). Because these errors are produced before authentication, authorization, or any resolver runs, an unauthenticated client possessing only the public application ID can trigger errors on Pointer or Relation fields to reconstruct hidden schema class names, partially defeating the schema-hiding protection. Only schema metadata (class names) is exposed; no object data, credentials, or user records are disclosed.