{"answers":{"affected":"1 open source package ship an affected version, including parse.","exploited":"There is no known exploitation of CVE-2026-66008 in the wild and no public exploit code.","fix":"Upgrade parse to a fixed version for your release line: 8.6.87 or 9.10.0.","what":"CVE-2026-66008 is a medium-severity vulnerability in parse-community parse-server, published on 24 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-66008 and fix it if it is affected.\n\nWhat it is: CVE-2026-66008 is a medium-severity vulnerability in parse-community parse-server, published on 24 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-66008 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- parse (Bitnami): affected from 8.2.2; fixed in 8.6.87, 9.10.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-66008/ (Markdown: https://insights.sbomify.com/CVE-2026-66008/index.md)","id":"CVE-2026-66008","markdown":"https://insights.sbomify.com/CVE-2026-66008/index.md","name":"CVE-2026-66008","record":{"aliases":["BIT-parse-2026-66008","GHSA-5fc6-2494-x3q8","GHSA-r2g6-4f6j-f6rf"],"analysis":{"component_type":"server_software","fix_type":"upgrade","impacts":["data_read"],"network_reachable":"yes","non_default_config":false,"product_category":"Parse Server","requires_auth":"none","summary":"Unauthenticated attackers can reveal hidden schema class names via GraphQL error messages in Parse Server, bypassing schema-hiding protections.","user_interaction":"not_required","vuln_class":"information_disclosure"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"VulnCheck","cpe":[],"cvss":{"score":6.3,"severity":"medium","source":"cna","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","version":"4.0"},"cwes":[{"id":"CWE-209","name":"Generation of Error Message Containing Sensitive Information"}],"description":"Parse Server versions \u003e= 9.0.0 before 9.10.0-alpha.6 and \u003e= 8.2.2 before 8.6.87 disclose Pointer and Relation target class names through GraphQL validation and input-coercion error messages when public schema introspection is disabled (graphQLPublicIntrospection: false, the default). Because these errors are produced before authentication, authorization, or any resolver runs, an unauthenticated client possessing only the public application ID can trigger errors on Pointer or Relation fields to reconstruct hidden schema class names, partially defeating the schema-hiding protection. Only schema metadata (class names) is exposed; no object data, credentials, or user records are disclosed.","ecosystems":["Bitnami"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages","id":"CVE-2026-66008","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Bitnami","product":null,"products":[],"type":"information_disclosure","year":"2026"},"n_packages":1,"n_references":2,"next":{"headline":"Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages","id":"CVE-2026-66009"},"packages":[{"ecosystem":"Bitnami","fixed":["8.6.87","9.10.0"],"introduced":["8.2.2","9.0.0"],"last_affected":[],"package":"parse","purl":"pkg:bitnami/parse","source":"BIT-parse-2026-66008"}],"prev":{"headline":"Datasets Path Traversal via Unsanitized file_name Metadata","id":"CVE-2026-66007"},"products":["parse-server"],"published":"2026-07-24","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"Bitnami","prefix":"BIT"},{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-07-28","vendors":["parse-community"]},"summary":"Unauthenticated attackers can reveal hidden schema class names via GraphQL error messages in Parse Server, bypassing schema-hiding protections.","url":"https://insights.sbomify.com/CVE-2026-66008/"}