CVE-2026-66009 affects parse-community's parse-server where versions >=9.0.0 before 9.10.0-alpha.5 and >=8.2.2 before 8.6.86 return GraphQL validation errors that disclose the names of required (non-null) custom input fields despite public introspection being disabled (graphQLPublicIntrospection: false). An unauthenticated client possessing only the public application ID can trigger these errors to infer required field names on classes it references by name. This behavior partially undermines the intent of disabling public introspection to hide schema details. The vulnerability does not expose stored data, credentials, optional field names, unreferenced class names, or Cloud Code function names.

An unauthenticated attacker with only the public application ID can obtain the names of required custom input fields through error messages, which partially defeats schema-hiding protections. However, no sensitive data, credentials, or other internal schema details are disclosed. This leakage could aid attackers in understanding the schema structure for further targeted attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to the public application ID or monitoring for unusual GraphQL validation error patterns. Avoid relying solely on disabling public introspection for schema hiding.