Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-czsu-zebt-puhd
Vulnerability ID VCID-czsu-zebt-puhd
Aliases CVE-2025-53364
GHSA-48q3-prgv-gm4w
Summary Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Starting in 5.3.0 and before 7.5.3 and 8.2.2, the Parse Server GraphQL API previously allowed public access to the GraphQL schema without requiring a session token or the master key. While schema introspection reveals only metadata and not actual data, this metadata can still expand the potential attack surface. This vulnerability is fixed in 7.5.3 and 8.2.2.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.01039 https://api.first.org/data/v1/epss?cve=CVE-2025-53364
epss 0.01039 https://api.first.org/data/v1/epss?cve=CVE-2025-53364
cvssv3.1 5.3 https://github.com/parse-community/parse-server
generic_textual MODERATE https://github.com/parse-community/parse-server
cvssv3.1 5.3 https://github.com/parse-community/parse-server/pull/9819
generic_textual MODERATE https://github.com/parse-community/parse-server/pull/9819
ssvc Track https://github.com/parse-community/parse-server/pull/9819
cvssv3.1 5.3 https://github.com/parse-community/parse-server/pull/9820
generic_textual MODERATE https://github.com/parse-community/parse-server/pull/9820
ssvc Track https://github.com/parse-community/parse-server/pull/9820
cvssv3.1 5.3 https://github.com/parse-community/parse-server/security/advisories/GHSA-48q3-prgv-gm4w
generic_textual MODERATE https://github.com/parse-community/parse-server/security/advisories/GHSA-48q3-prgv-gm4w
ssvc Track https://github.com/parse-community/parse-server/security/advisories/GHSA-48q3-prgv-gm4w
cvssv3.1 5.3 https://nvd.nist.gov/vuln/detail/CVE-2025-53364
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2025-53364
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2025-53364
https://github.com/parse-community/parse-server
https://nvd.nist.gov/vuln/detail/CVE-2025-53364
9819 https://github.com/parse-community/parse-server/pull/9819
9820 https://github.com/parse-community/parse-server/pull/9820
GHSA-48q3-prgv-gm4w https://github.com/advisories/GHSA-48q3-prgv-gm4w
GHSA-48q3-prgv-gm4w https://github.com/parse-community/parse-server/security/advisories/GHSA-48q3-prgv-gm4w
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/parse-community/parse-server
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/parse-community/parse-server/pull/9819
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-07-10T15:52:42Z/ Found at https://github.com/parse-community/parse-server/pull/9819
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/parse-community/parse-server/pull/9820
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-07-10T15:52:42Z/ Found at https://github.com/parse-community/parse-server/pull/9820
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/parse-community/parse-server/security/advisories/GHSA-48q3-prgv-gm4w
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-07-10T15:52:42Z/ Found at https://github.com/parse-community/parse-server/security/advisories/GHSA-48q3-prgv-gm4w
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2025-53364
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.77835
EPSS Score 0.01039
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T17:05:44.691661+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2025/53xxx/CVE-2025-53364.json 38.6.0