CVE-2026-105828: Generation of Error Message Containing Sensitive Information in parse-community parse-server

CVE-2026-105828 is an information disclosure vulnerability in parse-community's parse-server affecting versions >=8.2.2 <8.6.92 and >=9.0.0 <9.10.1-alpha.12. The vulnerability arises because GraphQL validation error messages leak hidden class names despite public introspection being disabled. Unauthenticated attackers possessing only the public Application Id can craft operations that cause unknown-argument or invalid enum value errors, thereby revealing pointer and relation target class names.

The vulnerability allows unauthenticated attackers to gain knowledge of internal class names that are intended to be hidden, potentially aiding further reconnaissance or targeted attacks. However, it does not grant direct access or modification capabilities. The CVSS 4.0 score is 6.3 (medium severity), reflecting the limited but meaningful information disclosure.

No explicit patch or remediation details are provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is applied, consider restricting access to the public Application Id or monitoring for unusual GraphQL validation error patterns.