Parse Server exposes the data schema via GraphQL API

Description

The Parse Server GraphQL API previously allowed public access to the GraphQL schema without requiring a session token or the master key. While schema introspection reveals only metadata and not actual data, this metadata can still expand the potential attack surface.

Recommendation

Update the parse-server package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 5.3.0, < 7.5.3

  >= 8.0.0, < 8.2.2**

• Patched version(s): **7.5.3

  8.2.2**

References

• GHSA-48q3-prgv-gm4w
• CVE-2025-53364
• CWE-497
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Prototype Pollution in lodash (GHSA-p6mc-m468-83gw) 5 - CVE-2020-8203
• Prototype Pollution in lodash (GHSA-p6mc-m468-83gw) 3 - CVE-2020-8203
• Parse Server before v3.4.1 vulnerable to Denial of Service - CVE-2019-1020012
• Prototype Pollution in lodash (GHSA-p6mc-m468-83gw) 2 - CVE-2020-8203

Tags:

npm

parse-server