CVE-2026-30854

MEDIUM

Parse Server 9.3.1-alpha.3-9.5.0-alpha.10 - Info Disclosure

Title source: llm
STIX 2.1

Description

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. From version 9.3.1-alpha.3 to before version 9.5.0-alpha.10, when graphQLPublicIntrospection is disabled, __type queries nested inside inline fragments (e.g. ... on Query { __type(name:"User") { name } }) bypass the introspection control, allowing unauthenticated users to perform type reconnaissance. __schema introspection is not affected. This issue has been patched in version 9.5.0-alpha.10.

References (1)

Scores

CVSS v3 5.3
EPSS 0.0002
EPSS Percentile 5.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-863
Status published
Products (4)
npm/parse-server 9.3.1-alpha.3 - 9.5.0-alpha.10npm
parseplatform/parse-server 9.3.1 alpha3 (2 CPE variants)
parseplatform/parse-server 9.5.0 alpha1 (9 CPE variants)
parseplatform/parse-server 9.4.0 - 9.5.0
Published Mar 07, 2026
Tracked Since Mar 08, 2026