Vulnerability Details CVE-2026-30854
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. From version 9.3.1-alpha.3 to before version 9.5.0-alpha.10, when graphQLPublicIntrospection is disabled, __type queries nested inside inline fragments (e.g. ... on Query { __type(name:"User") { name } }) bypass the introspection control, allowing unauthenticated users to perform type reconnaissance. __schema introspection is not affected. This issue has been patched in version 9.5.0-alpha.10.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.0
EPSS Ranking 4.7%
CVSS Severity
CVSS v3 Score 5.3
Products affected by CVE-2026-30854
-
cpe:2.3:a:parseplatform:parse-server:9.3.1
-
cpe:2.3:a:parseplatform:parse-server:9.4.0
-
cpe:2.3:a:parseplatform:parse-server:9.4.1
-
cpe:2.3:a:parseplatform:parse-server:9.5.0