CVE-2026-105828 Overview
CVE-2026-105828 is an information disclosure vulnerability in Parse Server affecting versions 8.2.2 before 8.6.92 and 9.0.0 before 9.10.1-alpha.12. GraphQL validation error messages leak hidden class names even when public introspection is disabled. Unauthenticated attackers possessing only the public Application Id can craft operations that trigger unknown-argument or invalid enum value errors. These errors reveal pointer and relation target class names that developers assumed were hidden. The flaw is classified under [CWE-209: Generation of Error Message Containing Sensitive Information].
Critical Impact
Unauthenticated attackers with only the public Application Id can enumerate hidden schema class names through GraphQL error messages, undermining introspection-disabled deployments.
Affected Products
- Parse Server versions 8.2.2 through 8.6.91
- Parse Server versions 9.0.0 through 9.10.1-alpha.11
- Parse Server deployments exposing the GraphQL endpoint with public introspection disabled
Discovery Timeline
- 2026-10-08 - CVE CVE-2026-105828 published to NVD
- 2026-10-08 - Last updated in NVD database
Technical Details for CVE-2026-105828
Vulnerability Analysis
Parse Server exposes a GraphQL API that reflects the data schema, including pointer and relation fields between classes. Administrators commonly disable public introspection to hide internal schema details from unauthenticated clients. The vulnerability bypasses that control by abusing GraphQL validation errors.
When a client submits an operation that references an unknown argument or an invalid enum value, Parse Server returns a validation error. The error message embeds the actual class name tied to the field being validated. An attacker can iterate through field names and enum values to systematically reveal hidden class names referenced by pointers and relations.
Exposure of class names enables follow-on attacks. Attackers can target hidden classes with authenticated queries, correlate internal data structures, and plan privilege or data access abuse against resources assumed to be concealed.
Root Cause
The root cause is verbose GraphQL validation error handling that fails to sanitize sensitive schema metadata before returning it to unauthenticated callers. The error path does not honor the introspection-disabled configuration, treating validation diagnostics as safe to disclose.
Attack Vector
The attack requires only network access to the Parse Server GraphQL endpoint and the public Application Id, which is distributed to client applications by design. The attacker issues crafted GraphQL operations with invalid arguments or enum values and parses the returned error messages to extract class names referenced by pointer and relation fields.
See the GitHub Security Advisory GHSA-6m77-f8xr-f723 and the Vulncheck Advisory on Parse Server for the full technical write-up.
Detection Methods for CVE-2026-105828
Indicators of Compromise
- Repeated GraphQL POST requests from a single source returning validation errors referencing field or enum names.
- Spikes in GraphQLError responses containing phrases such as Unknown argument or Expected type in Parse Server logs.
- Unauthenticated GraphQL traffic from clients that never progress to valid queries after multiple error responses.
Detection Strategies
- Enable verbose GraphQL request logging on Parse Server and alert on sustained error-to-success ratios above a baseline threshold.
- Deploy a web application firewall rule that flags GraphQL requests whose payloads enumerate argument names or enum values across sequential requests.
- Correlate Application Id usage patterns to detect clients issuing only error-triggering operations.
Monitoring Recommendations
- Centralize Parse Server access logs and GraphQL responses in a SIEM for retention and analytics.
- Track per-source-IP rates of GraphQL validation errors and alert on anomalous enumeration behavior.
- Review GraphQL error messages during penetration tests to confirm class names are no longer disclosed after patching.
How to Mitigate CVE-2026-105828
Immediate Actions Required
- Upgrade Parse Server to version 8.6.92 or later on the 8.x branch, or 9.10.1-alpha.12 or later on the 9.x branch.
- Audit GraphQL error logs for prior reconnaissance activity against the public endpoint.
- Restrict the GraphQL endpoint to authenticated contexts where feasible, in addition to patching.
Patch Information
Parse Server maintainers released fixes in versions 8.6.92 and 9.10.1-alpha.12. The patches sanitize GraphQL validation error messages so that class names are no longer embedded in responses when public introspection is disabled. Patch details are documented in the GitHub Security Advisory GHSA-6m77-f8xr-f723.
Workarounds
- Place the Parse Server GraphQL endpoint behind an authenticated reverse proxy to reject unauthenticated callers.
- Disable the GraphQL endpoint entirely if it is not required by production clients.
- Deploy a WAF rule to strip or rewrite GraphQL error payloads that contain class name references until patching is complete.
# Configuration example
# Upgrade Parse Server to a fixed release
npm install parse-server@8.6.92
# or for the 9.x branch
npm install parse-server@9.10.1-alpha.12
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
