Parse Server CVE-2026-64627

The Parse Server GraphQL API must be mounted and network-accessible; REST-only deployments are not affected. The attacker requires only the Parse public application ID, which is by design embedded in client applications and is not treated as a secret credential. No authentication tokens, session cookies, or privileged access are required. The vulnerability is effective specifically when graphQLPublicIntrospection is false - the setting that was intended to prevent schema disclosure - because the variable coercion error path was not covered by that control. Exploitation is limited to schema metadata enumeration and does not grant access to stored records, enable write operations, or affect availability; the iterative nature of the attack also means that detection is possible through anomaly analysis of high-volume coercion error responses.

The CVSS 4.0 score of 6.9 with vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:L reflects a zero-barrier, network-accessible attack with low confidentiality impact. The impact is bounded to schema metadata - type names, field names, function names - rather than stored data or credentials, which limits immediate business harm. No EPSS data was supplied in the input; no CISA KEV listing exists; no confirmed POC exploit code is present. Despite the moderate score, the combination of no authentication requirement, default-configuration exploitability, and the bypass nature of this finding (circumventing a prior fix) makes this a genuine upgrade priority for any Parse Server deployment with the GraphQL API mounted. The primary risk is reconnaissance enablement: enumerated schema details reduce attacker friction for designing targeted follow-on attacks against specific classes or Cloud Code endpoints.

An attacker extracts the Parse public application ID from a published mobile app binary or web client JavaScript bundle, then writes a scripted loop that submits GraphQL mutations with subtly misspelled input-object field names - for example 'emal' instead of 'email' - against the GraphQL endpoint. The server returns 'Did you mean: email?' in the coercion error response, confirming field existence; the attacker iterates across a domain-specific wordlist to enumerate the full set of class names, field names, and Cloud Code function names without the introspection block firing. No confirmed public exploit code exists at time of analysis.