{"id":"EUVD-2026-36534","enisaUuid":"3728bd39-8d16-36f8-b968-dd5d75c2fae7","description":"Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.78 and 9.9.1-alpha.2, Parse Server\u0027s GraphQL endpoint discloses schema metadata to unauthenticated callers through Did you mean ...? suggestions embedded in GraphQL validation-error messages. An unauthenticated caller who knows only the public application id can iteratively send malformed queries to reconstruct class names, field names, argument names, mutation names, and input-object fields. This issue has been patched in versions 8.6.78 and 9.9.1-alpha.2.","datePublished":"Jun 12, 2026, 6:21:31 PM","dateUpdated":"Jun 12, 2026, 8:04:40 PM","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/parse-community/parse-server/security/advisories/GHSA-8cph-rgr4-g5vj\nhttps://github.com/parse-community/parse-server/pull/10467\nhttps://github.com/parse-community/parse-server/pull/10468\n","aliases":"CVE-2026-47248\nGHSA-8cph-rgr4-g5vj\n","assigner":"GitHub_M","epss":0.29,"enisaIdProduct":[{"id":"61ceaccc-4148-3b54-8d09-3ff69bb5dc2f","product":{"name":"parse-server","vendor":{"name":"parse-community"}},"product_version":"\u003c 8.6.78"},{"id":"d4c31a78-af85-30ac-a3bc-bee6fd014414","product":{"name":"parse-server","vendor":{"name":"parse-community"}},"product_version":"9.0.0, \u003c 9.9.1-alpha.2"}],"enisaIdVendor":[{"id":"f3a554b3-8621-366d-aa73-5f4da9b56bd8","vendor":{"name":"parse-community"}}],"enisaIdVulnerability":[{"id":"0bfb1d3a-3807-3bdb-b184-d1f795e2ccf4","vulnerability":{"id":"CVE-2026-47248","description":"Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.78 and 9.9.1-alpha.2, Parse Server\u0027s GraphQL endpoint discloses schema metadata to unauthenticated callers through Did you mean ...? suggestions embedded in GraphQL validation-error messages. An unauthenticated caller who knows only the public application id can iteratively send malformed queries to reconstruct class names, field names, argument names, mutation names, and input-object fields. This issue has been patched in versions 8.6.78 and 9.9.1-alpha.2.","datePublished":"Jun 12, 2026, 6:21:31 PM","dateUpdated":"Jun 12, 2026, 8:04:40 PM","status":"PUBLISHED","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/parse-community/parse-server/security/advisories/GHSA-8cph-rgr4-g5vj\nhttps://github.com/parse-community/parse-server/pull/10467\nhttps://github.com/parse-community/parse-server/pull/10468\n","enisa_id":"EUVD-2026-36534\n","assigner":"GitHub_M","epss":0.29,"dataProcessed":"Nov 5, 2026, 7:18:36 AM","vulnerabilityProduct":[{"id":"c7963764-491c-3ba2-b0f2-46b173d09513","product":{"name":"parse-server","vendor":{"name":"parse-community"}},"product_version":"9.0.0, \u003c 9.9.1-alpha.2"},{"id":"ccae27dc-34f9-37eb-bd25-d02f5530fdfc","product":{"name":"parse-server","vendor":{"name":"parse-community"}},"product_version":"\u003c 8.6.78"}],"vulnerabilityVendor":[{"id":"5a592226-5c83-3cee-b8d1-06000491137e","vendor":{"name":"parse-community"}}]}},{"id":"97b70289-c6aa-3d78-ad55-8315b09b58ed","vulnerability":{"id":"GHSA-8cph-rgr4-g5vj","description":"Parse Server\u0027s GraphQL \"Did you mean ...?\" validation suggestions disclose schema to unauthenticated callers","datePublished":"May 29, 2026, 7:18:01 PM","dateUpdated":"Jun 12, 2026, 9:59:48 PM","baseScore":0.0,"references":"https://github.com/parse-community/parse-server/security/advisories/GHSA-8cph-rgr4-g5vj\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-47248\nhttps://github.com/parse-community/parse-server/pull/10467\nhttps://github.com/parse-community/parse-server/pull/10468\nhttps://github.com/parse-community/parse-server\n","enisa_id":"EUVD-2026-36534\n","aliases":"GHSA-8cph-rgr4-g5vj\nCVE-2026-47248\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:03 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}