Parse Server exposes the data schema via GraphQL API

Description

The Parse Server GraphQL API previously allowed public access to the GraphQL schema without requiring a session token or the master key. While schema introspection reveals only metadata and not actual data, this metadata can still expand the potential attack surface.

Recommendation

Update the parse-server package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 5.3.0, < 7.5.3

  >= 8.0.0, < 8.2.2**

• Patched version(s): **7.5.3

  8.2.2**

References

• GHSA-48q3-prgv-gm4w
• CVE-2025-53364
• CWE-497
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Parse Server affected by denial-of-service via unbounded query complexity in REST and GraphQL API - CVE-2026-30946
• Parse Server exposes auth data via /users/me endpoint - CVE-2026-33627
• Parse Server exposes auth data via verify password endpoint - CVE-2026-34215
• Parse Server vulnerable to brute force guessing of user sensitive data via search patterns - CVE-2022-36079

You might also like:

Exploiting Server Version Disclosure

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

parse-server