CVE-2026-109302: Incorrect Authorization in parse-community parse-server

The vulnerability in parse-community's parse-server affects versions 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14. The GraphQL introspection control mechanism is bypassed when queries are resolved from Apollo Server's automatic persisted query cache, as the control is only applied to operation text sent directly with requests. This enables unauthenticated attackers with knowledge of the public Application Id and client key to replay introspection queries cached by master or maintenance key clients, exposing the schema including private classes and fields.

An unauthenticated attacker can retrieve the GraphQL schema, including private class and field names, by replaying introspection queries cached by privileged clients. This information disclosure could aid attackers in understanding the backend data structure, potentially facilitating further attacks. However, the vulnerability does not grant direct access to data or modification capabilities. The CVSS 4.0 score is 6.3 (medium severity), reflecting network attack vector, low complexity, partial attack complexity, and no privileges or user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the public Application Id and client key to trusted parties only. Monitor for unusual GraphQL introspection query activity and consider disabling automatic persisted queries if feasible.