CVE-2026-27609 Details
Description
Parse Dashboard is a standalone dashboard for managing Parse Server apps. In versions 7.3.0-alpha.42 through 9.0.0-alpha.7, the AI Agent API endpoint (`POST /apps/:appId/agent`) lacks CSRF protection. An attacker can craft a malicious page that, when visited by an authenticated dashboard user, submits requests to the agent endpoint using the victim's session. The fix in version 9.0.0-alpha.8 adds CSRF middleware to the agent endpoint and embeds a CSRF token in the dashboard page. As a workaround, remove the `agent` configuration block from your dashboard configuration. Dashboards without an `agent` config are not affected.
A vulnerability exists in Parse Dashboard versions 7.3.0-alpha.42 prior to 9.0.0-alpha.7, where the AI Agent API endpoint lacks Cross-Site Request Forgery (CSRF) protection. This flaw allows an attacker to create a malicious page that, when accessed by an authenticated user, can send requests to the agent endpoint using the user's session. The vulnerability has been addressed in version 9.0.0-alpha.8, which introduces CSRF middleware to the agent endpoint and adds a CSRF token to the dashboard page. As a temporary measure, users can remove the 'agent' configuration block from their dashboard settings, as those dashboards will not be affected.
Users can update to Parse Dashboard version 9.0.0-alpha.8 or later, where this vulnerability has been patched. Alternatively, dashboards can be configured without the 'agent' block to avoid exposure to this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Feb 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-352 | Cross-Site Request Forgery (CSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| parseplatform parse dashboard | 7.3.0 alpha42 7.3.0 alpha43 7.3.0 alpha44 7.3.0 alpha5 7.3.0 alpha6 7.3.0 alpha7 7.3.0 alpha8 7.3.0 alpha9 7.4.0 alpha1 7.4.0 alpha2 7.4.0 alpha3 7.4.0 alpha4 7.4.0 alpha5 7.5.0 alpha1 7.5.0 alpha2 7.6.0 alpha1 7.6.0 alpha10 7.6.0 alpha11 7.6.0 alpha12 7.6.0 alpha13 7.6.0 alpha2 7.6.0 alpha3 7.6.0 alpha4 7.6.0 alpha5 7.6.0 alpha6 7.6.0 alpha7 7.6.0 alpha8 7.6.0 alpha9 8.0.0 alpha1 8.0.0 alpha2 8.0.0 alpha3 8.0.0 alpha4 8.0.0 alpha5 8.0.0 alpha6 8.1.0 alpha1 8.1.0 alpha10 8.1.0 alpha11 8.1.0 alpha12 8.1.0 alpha13 8.1.0 alpha2 8.1.0 alpha3 8.1.0 alpha4 8.1.0 alpha5 8.1.0 alpha6 8.1.0 alpha7 8.1.0 alpha8 8.1.0 alpha9 8.1.1 alpha1 8.2.0 alpha1 8.2.0 alpha10 8.2.0 alpha11 8.2.0 alpha12 8.2.0 alpha13 8.2.0 alpha14 8.2.0 alpha15 8.2.0 alpha16 8.2.0 alpha17 8.2.0 alpha18 8.2.0 alpha19 8.2.0 alpha2 8.2.0 alpha20 8.2.0 alpha21 8.2.0 alpha22 8.2.0 alpha23 8.2.0 alpha24 8.2.0 alpha25 8.2.0 alpha26 8.2.0 alpha27 8.2.0 alpha3 8.2.0 alpha4 8.2.0 alpha5 8.2.0 alpha6 8.2.0 alpha7 8.2.0 alpha8 8.2.0 alpha9 8.3.0 alpha1 8.3.0 alpha10 8.3.0 alpha11 8.3.0 alpha12 8.3.0 alpha13 8.3.0 alpha14 8.3.0 alpha15 8.3.0 alpha16 8.3.0 alpha17 8.3.0 alpha18 8.3.0 alpha19 8.3.0 alpha2 8.3.0 alpha20 8.3.0 alpha21 8.3.0 alpha22 8.3.0 alpha23 8.3.0 alpha24 8.3.0 alpha25 8.3.0 alpha26 8.3.0 alpha27 8.3.0 alpha28 8.3.0 alpha29 8.3.0 alpha3 8.3.0 alpha30 8.3.0 alpha31 8.3.0 alpha32 8.3.0 alpha33 8.3.0 alpha34 8.3.0 alpha35 8.3.0 alpha36 8.3.0 alpha37 8.3.0 alpha38 8.3.0 alpha39 8.3.0 alpha4 8.3.0 alpha40 8.3.0 alpha41 8.3.0 alpha42 8.3.0 alpha43 8.3.0 alpha5 8.3.0 alpha6 8.3.0 alpha7 8.3.0 alpha8 8.3.0 alpha9 8.4.0 alpha1 8.4.1 alpha1 8.4.1 alpha2 8.5.0 alpha1 8.5.0 alpha2 8.5.0 alpha3 8.5.0 alpha4 8.5.0 alpha5 8.5.0 alpha6 8.5.0 alpha7 9.0.0 alpha1 9.0.0 alpha2 9.0.0 alpha3 9.0.0 alpha4 9.0.0 alpha5 9.0.0 alpha6 9.0.0 alpha7 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 26, 2026 | Modified Analysis | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Feb 27, 2026 | Initial Analysis | [email protected] |
| Feb 25, 2026 | New CVE Received | [email protected] |