low3.7
CVE-2026-109302
Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 applies its GraphQL introspection control only to operation text sent directly with a request…
Impact
Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 applies its GraphQL introspection control only to operation text sent directly with a request, not to operations resolved from Apollo Server's automatic persisted query cache. Unauthenticated attackers holding the public Application Id and client key can replay an introspection query previously cached by a master or maintenance key client to retrieve the schema, including private class and field names.
Affected products
| Product | Affected versions |
|---|---|
| Parse Server 8.2.2 | before 8.6.94 |
| 9.0.0 | before 9.10.1-alpha.14 |
Versions were read from the advisory text. No structured product data has been published for this record yet.