Most recent entries from all

BIT-parse-2026-30854 — Parse Server: GraphQL `__type` introspection bypass via inline fragments when public introspection is disabled

Affected: Bitnami: parse

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. From version 9.3.1 to before version 9.5.0, when graphQLPublicIntrospection is disabled, __type queries nested inside inline fragments (e.g. ... on Query { __type(name:"User") { name } }) bypass the introspection control, allowing unauthenticated users to perform type reconnaissance. __schema introspection is not affected. This issue has been patched in version 9.5.0.

EUVD-2026-274996

fkie_cve-2026-30854

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. From version 9.3.1-alpha.3 to before version 9.5.0-alpha.10, when graphQLPublicIntrospection is disabled, __type queries nested inside inline fragments (e.g. ... on Query { __type(name:"User") { name } }) bypass the introspection control, allowing unauthenticated users to perform type reconnaissance. __schema introspection is not affected. This issue has been patched in version 9.5.0-alpha.10.

GHSA-q5q9-2rhp-33qw — Parse Server: GraphQL `__type` introspection bypass via inline fragments when public introspection is disabled

Affected: npm: parse-server

### Impact

When `graphQLPublicIntrospection` is disabled, `__type` queries nested inside inline fragments (e.g. `... on Query { __type(name:"User") { name } })` bypass the introspection control, allowing unauthenticated users to perform type reconnaissance. `__schema` introspection is not affected.

### Patches

The check was changed from a flat iteration over root-level selections to a recursive walk of all selection sets, detecting `__type` inside inline fragments at any depth.

### Workarounds

Require master key authentication at the network layer (e.g. reverse proxy) for the GraphQL endpoint.

### References

- GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-q5q9-2rhp-33qw - Fix Parse Server 9: https://github.com/parse-community/parse-server/releases/tag/9.5.0-alpha.10