6.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-47248

CVE-2026-47248: Parse Server's GraphQL "Did you mean ...?" validation suggestions disclose schema to unauthenticated callers

Impact

Parse Server's GraphQL endpoint discloses schema metadata to unauthenticated callers through Did you mean ...? suggestions embedded in GraphQL validation-error messages. An unauthenticated caller who knows only the public application id can iteratively send malformed queries to reconstruct class names, field names, argument names, mutation names, and input-object fields. This bypasses the IntrospectionControlPlugin enforced when graphQLPublicIntrospection: false (the default) and defeats the schema-hiding goal of prior advisories GHSA-48q3-prgv-gm4w and GHSA-q5q9-2rhp-33qw. Schema disclosure aids reconnaissance for downstream authorization probing but does not by itself leak object data or authentication material.

Patches

A new SchemaSuggestionsControlPlugin Apollo plugin strips the Did you mean ...? suffix from GraphQL validation-error messages during validationDidStart, which runs before any introspection gate. The plugin applies only when graphQLPublicIntrospection: false and the caller is not a master-key or maintenance-key holder, matching the trust model of the existing IntrospectionControlPlugin.

Workarounds

No code workaround is available short of disabling the GraphQL API (mountGraphQL: false). Operators who require disclosure-resistant validation errors should upgrade to a patched release.

Resources

GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-8cph-rgr4-g5vj
Fix Parse Server 9: https://github.com/parse-community/parse-server/pull/10467
Fix Parse Server 8: https://github.com/parse-community/parse-server/pull/10468

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-47248

CVE-2026-47248:

6.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
parse-server	npm	>= 9.0.0, < 9.9.1-alpha.2	9.9.1-alpha.2
parse-server	npm	< 8.6.78	8.6.78

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, GHSA-8cph-rgr4-g5vj, is an information disclosure issue in Parse Server's GraphQL endpoint. Unauthenticated users could send malformed queries and receive error messages containing 'Did you mean...?' suggestions. These suggestions revealed parts of the GraphQL schema, such as field names and types, which should have been protected. This bypasses existing introspection controls.

The analysis of the provided patches (for Parse Server 8 and 9) reveals that the fix involves introducing a new Apollo Server plugin called SchemaSuggestionsControlPlugin. This plugin hooks into the validationDidStart phase of the GraphQL request lifecycle.

The core of the fix is within the validationDidStart function of this new plugin. It checks if the request is from an unauthenticated user and if public introspection is disabled. If these conditions are met, it registers a callback that sanitizes the validationErrors array, stripping the 'Did you mean...?' suggestions from the error messages before they are sent back to the client.

The function ParseGraphQLServer._createApolloServer was also identified as relevant because it's where the new SchemaSuggestionsControlPlugin is registered, making the fix effective. The vulnerability was essentially a missing piece of security logic in the server's configuration, which this function is responsible for.

Therefore, the vulnerable function is conceptually the absence of the logic now present in SchemaSuggestionsControlPlugin.requestDidStart.validationDidStart. During exploitation, the GraphQL validation logic would execute without the sanitization provided by this new function, leading to the information leak. A runtime profiler would show activity within the GraphQL request handling and validation pipeline, and the fix is applied directly within this path.

Vulnerable functions

SchemaSuggestionsControlPlugin.requestDidStart.validationDidStart

src/GraphQL/ParseGraphQLServer.js

This function is part of the newly introduced `SchemaSuggestionsControlPlugin`. It hooks into the `validationDidStart` lifecycle of the Apollo Server. The vulnerability lies in the absence of this logic, which allowed detailed validation error messages, including 'Did you mean...?' suggestions, to be sent to unauthenticated users, thereby leaking schema information. This function, when triggered, checks if the user is authenticated and if public introspection is disabled. If so, it returns a function that sanitizes the validation errors by removing the suggestions. The vulnerability is exploited when this function is NOT present, and a malformed GraphQL query is sent.

ParseGraphQLServer._createApolloServer

src/GraphQL/ParseGraphQLServer.js

This function is responsible for creating and configuring the Apollo Server instance used by Parse Server's GraphQL API. The vulnerability existed because this function did not include a mechanism to prevent schema information from leaking through validation error messages. The patch modifies this function to include the new `SchemaSuggestionsControlPlugin` in the Apollo Server's plugin chain. This change ensures that the error sanitization logic is applied to all incoming GraphQL requests when appropriate.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.