CVE-2026-64627 Overview
CVE-2026-64627 is a schema disclosure vulnerability in Parse Server's GraphQL API. Affected versions include Parse Server >= 9.0.0 before 9.10.0-alpha.4 and versions before 8.6.85. When graphQLPublicIntrospection is set to false (the default), the server still returns schema-derived "Did you mean ...?" suggestions in error messages generated during variable coercion. An unauthenticated attacker with only the public application id can iteratively enumerate hidden schema identifiers, including Cloud Code function names, Parse class names, and field names. This flaw is a follow-up bypass of the earlier advisory GHSA-8cph-rgr4-g5vj.
Critical Impact
Unauthenticated attackers can extract otherwise hidden GraphQL schema identifiers, exposing internal Cloud Code functions and Parse class structures for follow-on attacks.
Affected Products
- Parse Server >= 9.0.0 and < 9.10.0-alpha.4
- Parse Server < 8.6.85
- Deployments with GraphQL API mounted and graphQLPublicIntrospection: false
Discovery Timeline
- 2026-07-21 - CVE CVE-2026-64627 published to NVD
- 2026-07-23 - Last updated in NVD database
Technical Details for CVE-2026-64627
Vulnerability Analysis
The vulnerability sits in Parse Server's GraphQL error handling path [CWE-209: Generation of Error Message Containing Sensitive Information]. Parse Server exposes a GraphQL endpoint that supports queries and mutations backed by user-defined Parse classes and Cloud Code functions. Administrators disable public introspection through graphQLPublicIntrospection: false to prevent enumeration of the schema.
The introspection-hardening control only suppresses schema hints in GraphQL validation errors. Errors produced during variable coercion, which occurs after validation, still contain schema-derived suggestions. When an attacker submits a query with a near-miss enum value or input-object field name, the resulting coercion error includes a "Did you mean ...?" hint containing the real identifier.
By iteratively probing enum types and input object fields, an unauthenticated caller recovers Cloud Code function names, Parse class names, and field names without authentication beyond the public application id.
Root Cause
The root cause is incomplete coverage of the introspection-hardening logic. The prior fix for GHSA-8cph-rgr4-g5vj scrubbed suggestion strings from validation errors but did not extend to variable coercion errors. GraphQL's default behavior of generating helpful "Did you mean ...?" suggestions leaks schema data through this alternate error path.
Attack Vector
An attacker sends unauthenticated HTTP requests to the GraphQL endpoint with only the public application id header. Each request contains a query or mutation whose variables include deliberately misspelled enum values or input-object field names. The server responds with error messages that include suggested valid identifiers, disclosing internal schema elements one probe at a time.
No verified proof-of-concept code has been published. See the GitHub Security Advisory and the VulnCheck Advisory for additional technical details.
Detection Methods for CVE-2026-64627
Indicators of Compromise
- Repeated GraphQL requests from a single source containing malformed enum values or input-object field names.
- GraphQL error responses containing "Did you mean" strings returned to unauthenticated clients.
- Elevated volumes of 4xx GraphQL responses tied to variable coercion failures.
Detection Strategies
- Log all GraphQL request bodies and correlate error responses that contain suggestion phrases such as Did you mean.
- Alert on unauthenticated GraphQL traffic where the only credential presented is the public application id header.
- Baseline normal GraphQL variable payloads and flag high-entropy or fuzzed variable values from a single IP.
Monitoring Recommendations
- Forward Parse Server access and error logs to a centralized analytics platform for query-pattern analysis.
- Track error-to-success ratios per client to identify enumeration behavior.
- Monitor for reconnaissance patterns targeting Cloud Code function names and Parse class fields.
How to Mitigate CVE-2026-64627
Immediate Actions Required
- Upgrade Parse Server to 9.10.0-alpha.4 or 8.6.85 immediately.
- Audit GraphQL access logs for enumeration attempts predating the upgrade.
- Rotate any Cloud Code function names or class identifiers considered sensitive if evidence of enumeration exists.
Patch Information
Parse Server maintainers fixed the issue in 9.10.0-alpha.4 and 8.6.85. The patch extends the introspection-hardening control to strip schema-derived suggestions from variable coercion errors, closing the bypass of GHSA-8cph-rgr4-g5vj. Refer to the GitHub Security Advisory for the full patch reference.
Workarounds
- Place a reverse proxy or WAF in front of the GraphQL endpoint to strip Did you mean suggestion strings from error responses.
- Require authentication on the GraphQL endpoint until upgrading is possible.
- Disable the GraphQL API on affected deployments if it is not in active use.
# Upgrade Parse Server to a patched release
npm install parse-server@8.6.85
# or for the 9.x line
npm install parse-server@9.10.0-alpha.4
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
