CVE-2026-66008 affects parse-community's parse-server. When public schema introspection is disabled (graphQLPublicIntrospection: false), error messages generated during GraphQL validation and input coercion leak Pointer and Relation target class names. These errors occur before any authentication or authorization checks, allowing unauthenticated clients with only the public application ID to trigger errors that reveal hidden schema class names. The vulnerability exposes only schema metadata, not sensitive data or credentials. Affected versions include 9.0.0 up to but not including 9.10.0-alpha.6 and 8.2.2 up to but not including 8.6.87.

The vulnerability allows unauthenticated attackers to obtain schema class names that are intended to be hidden by disabling public schema introspection. This partial disclosure undermines schema-hiding protections but does not expose any actual object data, user credentials, or sensitive information. There are no known exploits in the wild. The CVSS 4.0 base score is 6.3, indicating a medium severity impact primarily due to information disclosure without direct access to sensitive data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider enabling public schema introspection if acceptable, or implement additional access controls to limit unauthenticated GraphQL queries. Monitor vendor channels for updates and apply patches once released.