Parse Server exposes the data schema via GraphQL API

Description

The Parse Server GraphQL API previously allowed public access to the GraphQL schema without requiring a session token or the master key. While schema introspection reveals only metadata and not actual data, this metadata can still expand the potential attack surface.

Recommendation

Update the parse-server package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 5.3.0, < 7.5.3

  >= 8.0.0, < 8.2.2**

• Patched version(s): **7.5.3

  8.2.2**

References

• GHSA-48q3-prgv-gm4w
• CVE-2025-53364
• CWE-497
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Parse Server vulnerable to brute force guessing of user sensitive data via search patterns - CVE-2022-36079
• Parse Server is vulnerable to Server-Side Request Forgery (SSRF) via Instagram OAuth Adapter - CVE-2025-68150
• Parse Server Vulnerable to Server-Side Request Forgery (SSRF) in File Upload via URI Format - CVE-2025-64430
• Parse Server allows public `explain` queries which may expose sensitive database performance information and schema deta - CVE-2025-64502

Tags:

npm

parse-server