Is there a patch available for EUVD-2026-46180?

Yes, a patch is available for EUVD-2026-46180. Update the affected software to the latest version immediately.

Parse Server EUVD-2026-46180

Q: What is the CVSS score of EUVD-2026-46180?

EUVD-2026-46180 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-64627 MEDIUM

Error Message Information Leak (CWE-209)

2026-07-21 VulnCheck

GHSA-rjjh-vx7v-m7mf

Information Disclosure Parse Server

6.9

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.3 MEDIUM

Network-accessible with no prerequisite beyond the public app ID; confidentiality impact is low, limited to schema metadata; no integrity or availability impact applies.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 21, 2026 - 13:17 EUVD

Analysis Generated

Jul 21, 2026 - 12:31 vuln.today

DescriptionCVE.org

Parse Server versions >= 9.0.0 before 9.10.0-alpha.4 and versions before 8.6.85 contain a schema disclosure vulnerability. When the GraphQL API is mounted with public introspection disabled (graphQLPublicIntrospection: false, the default), schema-derived 'Did you mean ...?' suggestions were still returned in GraphQL error messages produced during variable coercion, which were not covered by the introspection-hardening control (that only handled validation errors). An unauthenticated caller possessing only the public application id can iteratively recover hidden schema identifiers - including registered Cloud Code function names and Parse class and field names - by submitting queries or mutations whose variables contain near-miss enum values or input-object field names. This is a follow-up bypass of GHSA-8cph-rgr4-g5vj. The issue is fixed in 9.10.0-alpha.4 and 8.6.85.

AnalysisAI

Schema identifier disclosure in Parse Server allows unauthenticated callers to reconstruct hidden GraphQL schema elements by exploiting 'Did you mean ...?' suggestions emitted during variable coercion error handling - a pathway left ungated by the graphQLPublicIntrospection: false hardening control, which only covered the validation phase. Affected versions span the 9.x line (9.0.0 through 9.10.0-alpha.4) and the 8.x line (before 8.6.85), and the flaw represents a confirmed bypass of prior fix GHSA-8cph-rgr4-g5vj. An attacker bearing only the public application ID can iteratively enumerate Cloud Code function names, Parse class names, and field names without triggering the introspection guard; no public exploit code is confirmed and no CISA KEV listing is present at time of analysis.

Technical ContextAI

Parse Server (cpe:2.3:a:parse-community:parse-server) is an open-source Node.js backend-as-a-service framework that exposes an optional GraphQL API layer. When graphQLPublicIntrospection is set to false - the default - the server blocks standard introspection queries at the GraphQL validation phase. However, the hardening logic did not extend to the variable coercion phase, which runs earlier in the request lifecycle when the GraphQL engine resolves runtime variable values against schema type definitions. During coercion failures, the engine emits diagnostic 'Did you mean X?' suggestions drawn directly from registered type members - enum values, input object field names, Cloud Code function names, and Parse class and field names. CWE-209 (Generation of Error Message Containing Sensitive Information) precisely characterizes this root cause: schema-internal identifiers leak through error messages that were never subject to the introspection access control.

RemediationAI

Upgrade Parse Server to version 9.10.0-alpha.4 or later if running the 9.x branch, or to 8.6.85 or later if running the 8.x branch; both are vendor-confirmed fixed releases per the advisory at https://github.com/parse-community/parse-server/security/advisories/GHSA-9g8f-h8f3-hjcm. If an immediate upgrade is not operationally feasible, disabling the GraphQL API entirely by not mounting the GraphQL handler eliminates the attack surface at the cost of losing GraphQL functionality for all clients. No configuration-only workaround is known that preserves GraphQL service while blocking this bypass, because the coercion phase that leaks suggestions runs independently of the introspection flag's enforcement point.