CVE-2026-64627 affects parse-community's parse-server. The vulnerability arises when the GraphQL API is mounted with public introspection disabled (graphQLPublicIntrospection: false), yet error messages generated during variable coercion still include 'Did you mean ...?' suggestions derived from the schema. These suggestions were not covered by the introspection-hardening control, which only handled validation errors. An unauthenticated attacker possessing only the public application ID can exploit this by submitting queries or mutations with near-miss enum values or input-object field names, thereby iteratively recovering hidden schema identifiers including registered Cloud Code function names and Parse class and field names. This vulnerability is a follow-up bypass of a previous advisory (GHSA-8cph-rgr4-g5vj). The issue is fixed in parse-server versions 9.10.0-alpha.4 and 8.6.85.

The vulnerability allows unauthenticated attackers to disclose sensitive schema information that was intended to be hidden by disabling public introspection. This includes internal Cloud Code function names and class/field names, which could aid attackers in crafting more targeted attacks or understanding the internal application structure. The exposure is limited to schema identifiers and does not indicate direct data access or code execution. The CVSS 4.0 base score is 6.9, reflecting a medium severity with network attack vector, no privileges required, no user interaction, and low impact on confidentiality.

The vulnerability is fixed in parse-server versions 9.10.0-alpha.4 and 8.6.85. Users should upgrade to at least one of these versions to remediate the issue. Since no official remediation level or patch links are provided beyond this, upgrading to these fixed versions is the recommended action. Patch status is confirmed by the vendor advisory stating the fix is included in these versions.