CVE-2026-109302: Parse Server GraphQL Schema Disclosure Vulnerability
Summary
CVE-2026-109302: Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1 applies its GraphQL introspection control only to operation text sent directly with a request, not to operations resolved from Apollo Server's automatic persisted... Affects parse across 2 version ranges.
>= 8.2.2, < 8.6.94
>= 9.0.0, < 9.10.1
Fixed in 8.6.94 or 9.10.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Parse Server is an open-source backend platform that enables developers to build applications quickly and efficiently. It provides a range of features including data storage, user management, and real-time notifications. However, certain versions of Parse Server (8.2.2 to 8.6.94 and 9.0.0 to 9.10.1) are vulnerable to a GraphQL schema disclosure issue, which can expose sensitive information to unauthorized users.
Vulnerability Detail
The vulnerability arises from the way Parse Server handles GraphQL introspection queries. Specifically, it applies introspection controls only to operation text sent directly with a request, neglecting operations resolved from Apollo Server's automatic persisted query cache. This oversight allows unauthenticated attackers with access to the public Application Id and client key to replay cached introspection queries, potentially revealing the entire GraphQL schema, including private class and field names. This could lead to unauthorized access to sensitive data and compromise the application's security.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 8.2.2, < 8.6.948.6.94 -
>= 9.0.0, < 9.10.19.10.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, developers can disable the use of persisted queries in their Apollo Server configuration, which will prevent the caching of introspection queries. This can be done by setting the 'usePersistedQueries' option to false in the Apollo Server setup. Example code:
const { ApolloServer } = require('apollo-server');
const server = new ApolloServer({
typeDefs,
resolvers,
persistedQueries: false // Disable persisted queries
});
Conclusion
In summary, CVE-2026-109302 is a significant vulnerability in certain versions of Parse Server that can lead to unauthorized disclosure of sensitive GraphQL schema information. It is crucial for users to update to the latest patched versions to mitigate this risk and ensure the security of their applications.
See every vulnerability recorded for parse →
FAQ
CVE-2026-109302 is a vulnerability in Parse Server that allows unauthorized access to GraphQL schema information through cached introspection queries.
The affected versions are Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include unauthorized access to sensitive data, exposure of private class and field names, and potential data breaches.
You can update Parse Server by running the command 'npm install parse@latest' in your terminal to ensure you have the latest security patches.
References
Related vulnerabilities
Recent vulnerabilities recorded for parse.
