Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2026-27609 Details

Description

Parse Dashboard is a standalone dashboard for managing Parse Server apps. In versions 7.3.0-alpha.42 through 9.0.0-alpha.7, the AI Agent API endpoint (`POST /apps/:appId/agent`) lacks CSRF protection. An attacker can craft a malicious page that, when visited by an authenticated dashboard user, submits requests to the agent endpoint using the victim's session. The fix in version 9.0.0-alpha.8 adds CSRF middleware to the agent endpoint and embeds a CSRF token in the dashboard page. As a workaround, remove the `agent` configuration block from your dashboard configuration. Dashboards without an `agent` config are not affected.

Metrics

CVSS 3.x Severity and Vector Strings:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

Weakness Enumeration

CWE-IDCWE NameSource
CWE-352Cross-Site Request Forgery (CSRF)[email protected]

Affected Products

ProductVersions
parseplatform parse dashboard
7.3.0 alpha42
7.3.0 alpha43
7.3.0 alpha44
7.3.0 alpha5
7.3.0 alpha6

CPE

  • cpe:2.3:a:parseplatform:parse_dashboard:7.3.0:alpha42:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:7.3.0:alpha43:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:7.3.0:alpha44:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:7.3.0:alpha5:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:7.3.0:alpha6:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:7.3.0:alpha7:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:7.3.0:alpha8:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:7.3.0:alpha9:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:7.4.0:alpha1:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:7.4.0:alpha2:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:7.4.0:alpha3:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:7.4.0:alpha4:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:7.4.0:alpha5:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:7.5.0:alpha1:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:7.5.0:alpha2:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:7.6.0:alpha1:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:7.6.0:alpha10:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:7.6.0:alpha11:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:7.6.0:alpha12:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:7.6.0:alpha13:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:7.6.0:alpha2:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:7.6.0:alpha3:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:7.6.0:alpha4:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:7.6.0:alpha5:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:7.6.0:alpha6:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:7.6.0:alpha7:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:7.6.0:alpha8:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:7.6.0:alpha9:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.0.0:alpha1:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.0.0:alpha2:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.0.0:alpha3:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.0.0:alpha4:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.0.0:alpha5:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.0.0:alpha6:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.1.0:alpha1:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.1.0:alpha10:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.1.0:alpha11:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.1.0:alpha12:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.1.0:alpha13:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.1.0:alpha2:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.1.0:alpha3:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.1.0:alpha4:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.1.0:alpha5:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.1.0:alpha6:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.1.0:alpha7:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.1.0:alpha8:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.1.0:alpha9:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.1.1:alpha1:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha1:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha10:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha11:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha12:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha13:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha14:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha15:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha16:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha17:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha18:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha19:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha2:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha20:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha21:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha22:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha23:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha24:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha25:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha26:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha27:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha3:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha4:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha5:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha6:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha7:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha8:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha9:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha1:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha10:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha11:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha12:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha13:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha14:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha15:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha16:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha17:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha18:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha19:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha2:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha20:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha21:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha22:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha23:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha24:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha25:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha26:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha27:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha28:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha29:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha3:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha30:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha31:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha32:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha33:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha34:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha35:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha36:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha37:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha38:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha39:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha4:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha40:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha41:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha42:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha43:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha5:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha6:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha7:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha8:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha9:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.4.0:alpha1:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.4.1:alpha1:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.4.1:alpha2:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.5.0:alpha1:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.5.0:alpha2:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.5.0:alpha3:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.5.0:alpha4:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.5.0:alpha5:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.5.0:alpha6:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:8.5.0:alpha7:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:9.0.0:alpha1:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:9.0.0:alpha2:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:9.0.0:alpha3:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:9.0.0:alpha4:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:9.0.0:alpha5:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:9.0.0:alpha6:*:*:*:node.js:*:*
  • cpe:2.3:a:parseplatform:parse_dashboard:9.0.0:alpha7:*:*:*:node.js:*:*

Remediation

  • No remediation found in references.

Change History

5 change records found show changes


QUICK INFO

CVE Dictionary Entry:
CVE-2026-27609
NVD Published Date:
Feb 25, 2026
NVD Last Modified:
Jun 26, 2026
Source:
[email protected]
CVE-2026-27609 Details - Not Deferred