This vulnerability in parse-community's parse-server affects versions >=9.0.0 <9.10.0-alpha.4 and <8.6.85. It arises because error messages generated during GraphQL variable coercion leak schema-derived 'Did you mean ...?' suggestions even when public introspection is disabled (graphQLPublicIntrospection: false). These suggestions expose internal schema identifiers, including Cloud Code function names and Parse class and field names, which should remain hidden. An unauthenticated attacker possessing only the public application ID can exploit this by submitting queries or mutations with near-miss enum values or input-object field names to iteratively recover sensitive schema information. This vulnerability bypasses previous introspection restrictions that only covered validation errors. The issue has been fixed in parse-server versions 9.10.0-alpha.4 and 8.6.85.

An unauthenticated attacker can disclose sensitive schema information that is intended to be hidden by the GraphQL introspection controls. This includes internal identifiers such as Cloud Code function names and class/field names. Such information disclosure can aid attackers in crafting more targeted attacks or understanding the internal structure of the application. However, the vulnerability does not require authentication and does not directly allow code execution or data modification.

The vulnerability is fixed in parse-server versions 9.10.0-alpha.4 and 8.6.85. Users should upgrade to at least these versions to remediate the issue. Patch status is not explicitly stated as 'official-fix' or 'patchAvailable' but the vendor has released fixed versions. Until upgrading, consider restricting access to the GraphQL API or disabling it if not needed. No vendor advisory content contradicts these recommendations.