CVE-2026-66008 is a vulnerability in parse-community's parse-server where error messages generated during GraphQL validation and input coercion disclose Pointer and Relation target class names. This occurs when the public schema introspection feature is disabled (graphQLPublicIntrospection: false). Because these error messages are produced before any authentication, authorization, or resolver execution, an unauthenticated attacker with only the public application ID can trigger errors on Pointer or Relation fields to reconstruct hidden schema class names. The exposure is limited to schema metadata and does not include any object data, credentials, or user records. The affected version explicitly stated is 9.0.0.

The vulnerability allows unauthenticated attackers to gain partial knowledge of the hidden schema by revealing class names through error messages. This partially defeats the schema-hiding protection intended by disabling public schema introspection. However, no sensitive data such as user information, credentials, or actual object data is disclosed. The impact is limited to information disclosure of schema metadata.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider monitoring for updates from the parse-community project. Since the vulnerability arises from error messages revealing schema details before authentication, temporary mitigations might include customizing error handling to avoid leaking schema information, if feasible.