CVE-2026-27609

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27609", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-20T19:43:14.602Z", "datePublished": "2026-02-25T02:18:28.909Z", "dateUpdated": "2026-02-27T17:24:51.491Z"}, "containers": {"cna": {"title": "Parse Dashboard Missing CSRF Protection on Agent Endpoint", "problemTypes": [{"descriptions": [{"cweId": "CWE-352", "lang": "en", "description": "CWE-352: Cross-Site Request Forgery (CSRF)", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "baseScore": 8.3, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/parse-community/parse-dashboard/security/advisories/GHSA-3534-xp88-25rc", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/parse-community/parse-dashboard/security/advisories/GHSA-3534-xp88-25rc"}, {"name": "https://github.com/parse-community/parse-dashboard/releases/tag/9.0.0-alpha.8", "tags": ["x_refsource_MISC"], "url": "https://github.com/parse-community/parse-dashboard/releases/tag/9.0.0-alpha.8"}], "affected": [{"vendor": "parse-community", "product": "parse-dashboard", "versions": [{"version": ">= 7.3.0-alpha.42, < 9.0.0-alpha.8", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-25T02:18:28.909Z"}, "descriptions": [{"lang": "en", "value": "Parse Dashboard is a standalone dashboard for managing Parse Server apps. In versions 7.3.0-alpha.42 through 9.0.0-alpha.7, the AI Agent API endpoint (`POST /apps/:appId/agent`) lacks CSRF protection. An attacker can craft a malicious page that, when visited by an authenticated dashboard user, submits requests to the agent endpoint using the victim's session. The fix in version 9.0.0-alpha.8 adds CSRF middleware to the agent endpoint and embeds a CSRF token in the dashboard page. As a workaround, remove the `agent` configuration block from your dashboard configuration. Dashboards without an `agent` config are not affected."}], "source": {"advisory": "GHSA-3534-xp88-25rc", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-27T17:24:42.522909Z", "id": "CVE-2026-27609", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-27T17:24:51.491Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27609", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-27T17:24:42.522909Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-27T17:24:47.500Z"}}], "cna": {"title": "Parse Dashboard Missing CSRF Protection on Agent Endpoint", "source": {"advisory": "GHSA-3534-xp88-25rc", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "parse-community", "product": "parse-dashboard", "versions": [{"status": "affected", "version": ">= 7.3.0-alpha.42, < 9.0.0-alpha.8"}]}], "references": [{"url": "https://github.com/parse-community/parse-dashboard/security/advisories/GHSA-3534-xp88-25rc", "name": "https://github.com/parse-community/parse-dashboard/security/advisories/GHSA-3534-xp88-25rc", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/parse-community/parse-dashboard/releases/tag/9.0.0-alpha.8", "name": "https://github.com/parse-community/parse-dashboard/releases/tag/9.0.0-alpha.8", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Parse Dashboard is a standalone dashboard for managing Parse Server apps. In versions 7.3.0-alpha.42 through 9.0.0-alpha.7, the AI Agent API endpoint (`POST /apps/:appId/agent`) lacks CSRF protection. An attacker can craft a malicious page that, when visited by an authenticated dashboard user, submits requests to the agent endpoint using the victim's session. The fix in version 9.0.0-alpha.8 adds CSRF middleware to the agent endpoint and embeds a CSRF token in the dashboard page. As a workaround, remove the `agent` configuration block from your dashboard configuration. Dashboards without an `agent` config are not affected."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352: Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-25T02:18:28.909Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27609", "state": "PUBLISHED", "dateUpdated": "2026-02-27T17:24:51.491Z", "dateReserved": "2026-02-20T19:43:14.602Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-25T02:18:28.909Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "parse-dashboard", "vendor": "parse-community", "versions": [{"status": "affected", "version": ">= 7.3.0-alpha.42, < 9.0.0-alpha.8"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.3.0:alpha42:*:*:*:node.js:*:*", "matchCriteriaId": "07E54A25-BB5E-4E4F-B3EC-0B9979CC067D", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.3.0:alpha43:*:*:*:node.js:*:*", "matchCriteriaId": "C8E605D1-F9FB-4AB4-9FFA-211F01496FEB", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.3.0:alpha44:*:*:*:node.js:*:*", "matchCriteriaId": "0E68DA89-5409-4F06-A69A-7C4672D10521", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.3.0:alpha5:*:*:*:node.js:*:*", "matchCriteriaId": "F41426EE-2CD5-4E74-A4D0-1B3BA49A9481", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.3.0:alpha6:*:*:*:node.js:*:*", "matchCriteriaId": "97BF4F76-319D-4DE8-A6E4-A8F08D384C59", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.3.0:alpha7:*:*:*:node.js:*:*", "matchCriteriaId": "83A19B88-2B7B-4C19-ABC9-AB01574608D2", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.3.0:alpha8:*:*:*:node.js:*:*", "matchCriteriaId": "B96B7FF8-7BF6-48B8-9887-EA7D9327DF35", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.3.0:alpha9:*:*:*:node.js:*:*", "matchCriteriaId": "014B82A6-F7D9-4B05-8D36-31781D177D9D", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.4.0:alpha1:*:*:*:node.js:*:*", "matchCriteriaId": "E6B6F40D-5FD8-4EF9-9AE9-DCA471C5CAFC", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.4.0:alpha2:*:*:*:node.js:*:*", "matchCriteriaId": "04966183-2013-4AC5-95C0-C3536AE97D3F", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.4.0:alpha3:*:*:*:node.js:*:*", "matchCriteriaId": "00572EFD-7E41-42D9-8412-0C25F9AAABE8", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.4.0:alpha4:*:*:*:node.js:*:*", "matchCriteriaId": "E444707A-C905-485C-8CDB-AE3B8780C56A", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.4.0:alpha5:*:*:*:node.js:*:*", "matchCriteriaId": "49327FD3-E9B0-4245-8126-EF44DDE6EB17", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.5.0:alpha1:*:*:*:node.js:*:*", "matchCriteriaId": "F068BEBE-FF4F-45BA-A3ED-C1A4E6ACA2FF", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.5.0:alpha2:*:*:*:node.js:*:*", "matchCriteriaId": "819B012F-E02A-4E7E-8935-F534270F8A80", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.6.0:alpha1:*:*:*:node.js:*:*", "matchCriteriaId": "25C0D991-B416-4BC1-882A-61FFB3E815CB", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.6.0:alpha10:*:*:*:node.js:*:*", "matchCriteriaId": "44D86A4C-7105-42BE-82B3-15736D0C7164", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.6.0:alpha11:*:*:*:node.js:*:*", "matchCriteriaId": "8EFB3F3E-4F2F-4975-8B5D-CC6E17489386", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.6.0:alpha12:*:*:*:node.js:*:*", "matchCriteriaId": "BADD19AE-F281-4222-B7BE-535EC4045F4B", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.6.0:alpha13:*:*:*:node.js:*:*", "matchCriteriaId": "EB952B96-D2A1-4706-8054-C3DB72388E49", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.6.0:alpha2:*:*:*:node.js:*:*", "matchCriteriaId": "B867C0D1-DB8B-44E9-B147-F92A74BF0B98", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.6.0:alpha3:*:*:*:node.js:*:*", "matchCriteriaId": "5AE07136-83B7-4DE5-9F90-3C3B11E0AF78", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.6.0:alpha4:*:*:*:node.js:*:*", "matchCriteriaId": "5EA360CA-BFAB-4CDE-AD59-CC10F5D0601B", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.6.0:alpha5:*:*:*:node.js:*:*", "matchCriteriaId": "0471F4A9-2DF0-429E-86BA-267F8DA92319", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.6.0:alpha6:*:*:*:node.js:*:*", "matchCriteriaId": "74421939-B72D-41DA-A276-2137C8D87A3C", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.6.0:alpha7:*:*:*:node.js:*:*", "matchCriteriaId": "620A6F14-7697-4B03-A116-6E54DD6DD806", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.6.0:alpha8:*:*:*:node.js:*:*", "matchCriteriaId": "6959259A-2208-42B9-8FD4-65BB60F8A355", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.6.0:alpha9:*:*:*:node.js:*:*", "matchCriteriaId": "F1E70933-B30D-493C-A8BA-20FA873E3AFD", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.0.0:alpha1:*:*:*:node.js:*:*", "matchCriteriaId": "59953623-4467-4BF8-916D-7FAF85E7B112", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.0.0:alpha2:*:*:*:node.js:*:*", "matchCriteriaId": "006F6095-1A9A-4418-B7A3-9040823B6D0E", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.0.0:alpha3:*:*:*:node.js:*:*", "matchCriteriaId": "A7902611-FAC7-43A6-A86A-0B6D232EE3F8", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.0.0:alpha4:*:*:*:node.js:*:*", "matchCriteriaId": "ACC8F371-7DA0-4269-9080-3CCEF0F193FF", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.0.0:alpha5:*:*:*:node.js:*:*", "matchCriteriaId": "E7835681-3581-4834-B6F1-0F48CD5231F4", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.0.0:alpha6:*:*:*:node.js:*:*", "matchCriteriaId": "4760B32F-6943-4BC6-9893-ECE12839291D", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.1.0:alpha1:*:*:*:node.js:*:*", "matchCriteriaId": "F1598567-50D0-4D26-9B60-6067E8070D9B", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.1.0:alpha10:*:*:*:node.js:*:*", "matchCriteriaId": "02CDB7B1-5CD7-402D-ACDA-CFD5DCCA1455", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.1.0:alpha11:*:*:*:node.js:*:*", "matchCriteriaId": "4E461A18-5EB0-4E9E-9670-82B2ABF568F4", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.1.0:alpha12:*:*:*:node.js:*:*", "matchCriteriaId": "794EE02E-6D86-4E4D-9F00-443BFFB78C54", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.1.0:alpha13:*:*:*:node.js:*:*", "matchCriteriaId": "6120C309-768A-4477-BF34-0AD21A104A19", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.1.0:alpha2:*:*:*:node.js:*:*", "matchCriteriaId": "4314A7D2-5CA8-4081-BF2B-88A7175B14FE", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.1.0:alpha3:*:*:*:node.js:*:*", "matchCriteriaId": "A222119F-5962-49E2-94B5-C3BBC8B19584", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.1.0:alpha4:*:*:*:node.js:*:*", "matchCriteriaId": "7F8A9B5B-A1CE-4C86-A031-E638FDEAFE8A", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.1.0:alpha5:*:*:*:node.js:*:*", "matchCriteriaId": "D5365B15-3725-4E8B-A0BA-2D4513706AEC", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.1.0:alpha6:*:*:*:node.js:*:*", "matchCriteriaId": "CEE8CA47-2A8A-44F4-8ABC-C899DA12A49C", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.1.0:alpha7:*:*:*:node.js:*:*", "matchCriteriaId": "B4065C00-6E46-4B19-B32F-9A485EF9AAB4", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.1.0:alpha8:*:*:*:node.js:*:*", "matchCriteriaId": "E6A9E323-7A79-4068-A596-826DB8393273", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.1.0:alpha9:*:*:*:node.js:*:*", "matchCriteriaId": "F07743D3-82D8-425E-918E-D689DFF5B456", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.1.1:alpha1:*:*:*:node.js:*:*", "matchCriteriaId": "77DE8253-E642-4247-8AD7-444C658C11B7", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha1:*:*:*:node.js:*:*", "matchCriteriaId": "45558A90-0C09-485F-BC7A-DC7403AADA9F", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha10:*:*:*:node.js:*:*", "matchCriteriaId": "147EA8FF-8CCD-442C-A9AF-B3B413AC08AD", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha11:*:*:*:node.js:*:*", "matchCriteriaId": "DE95BEF0-E579-4EAF-BC5D-49C6A097A029", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha12:*:*:*:node.js:*:*", "matchCriteriaId": "B9C9BAF7-52AA-4117-9EB9-15B23625BB4A", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha13:*:*:*:node.js:*:*", "matchCriteriaId": "751EF4D4-017A-40E6-A4DA-73CE3E6E6F18", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha14:*:*:*:node.js:*:*", "matchCriteriaId": "909CEA7C-20A0-4E59-80CA-ECED455AB0A4", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha15:*:*:*:node.js:*:*", "matchCriteriaId": "9CDE7AA9-E25F-4614-8824-75BD61137383", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha16:*:*:*:node.js:*:*", "matchCriteriaId": "62F4B0D7-F3C2-4279-97D7-027FA84A69D0", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha17:*:*:*:node.js:*:*", "matchCriteriaId": "AB00F9FE-2BC9-4DDC-90EC-BB4E344D7FAE", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha18:*:*:*:node.js:*:*", "matchCriteriaId": "F747C7B3-7B22-4977-ACA6-A61A72966EBA", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha19:*:*:*:node.js:*:*", "matchCriteriaId": "CFA065EB-17EF-4BDC-90C3-7612DA0BAEE3", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha2:*:*:*:node.js:*:*", "matchCriteriaId": "3D063244-3964-4538-BD71-444C4AC78159", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha20:*:*:*:node.js:*:*", "matchCriteriaId": "14F2E6D0-BF45-44C6-B09E-BBCB0D9A5B9D", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha21:*:*:*:node.js:*:*", "matchCriteriaId": "A035B1BF-8A6E-43BD-B497-5880069DE701", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha22:*:*:*:node.js:*:*", "matchCriteriaId": "EA0EF875-506C-41F6-9982-C615BD7F736A", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha23:*:*:*:node.js:*:*", "matchCriteriaId": "C685FFA6-8C20-4E45-8C8F-7CAE843272E7", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha24:*:*:*:node.js:*:*", "matchCriteriaId": "E5069E97-CAAC-4609-A679-D9ED85E46183", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha25:*:*:*:node.js:*:*", "matchCriteriaId": "0A3896DE-2FEE-4745-93D4-20B94CF821B0", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha26:*:*:*:node.js:*:*", "matchCriteriaId": "12BB3FFA-33B6-46DA-B128-41F1B569EEDA", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha27:*:*:*:node.js:*:*", "matchCriteriaId": "1BEA50F8-8F8C-4CF2-A0D2-83FE4A417984", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha3:*:*:*:node.js:*:*", "matchCriteriaId": "68AAA2B1-BCFA-47B5-B340-CD7B182EE0DD", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha4:*:*:*:node.js:*:*", "matchCriteriaId": "FB746E76-8E6D-4AA1-9E41-8B621F6B0817", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha5:*:*:*:node.js:*:*", "matchCriteriaId": "8606D8A6-3670-4C7A-89C0-C79B47DAE462", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha6:*:*:*:node.js:*:*", "matchCriteriaId": "AC53D1E9-E4DE-47BD-961A-AE3B201E6D9B", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha7:*:*:*:node.js:*:*", "matchCriteriaId": "11921795-B289-49B8-9B13-9E4D092DAD1D", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha8:*:*:*:node.js:*:*", "matchCriteriaId": "C9CC23DE-F84D-48F3-9474-65B240B4A773", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha9:*:*:*:node.js:*:*", "matchCriteriaId": "4D0E3EE7-57AD-469E-8C16-58A797413D09", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha1:*:*:*:node.js:*:*", "matchCriteriaId": "6E8CFB57-3235-48EF-85AA-6F93F75DBFFE", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha10:*:*:*:node.js:*:*", "matchCriteriaId": "298D7F20-184C-4D46-9BD0-952A5238CE38", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha11:*:*:*:node.js:*:*", "matchCriteriaId": "4EDA824F-BDD0-45CF-8707-90152F0DC8A5", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha12:*:*:*:node.js:*:*", "matchCriteriaId": "EFC686E3-4ACA-4DCE-8619-872A1D5A00E6", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha13:*:*:*:node.js:*:*", "matchCriteriaId": "62C667AB-C243-4EE5-A11F-903548659361", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha14:*:*:*:node.js:*:*", "matchCriteriaId": "BE5FFADF-61A9-4020-A440-A87513F8D16E", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha15:*:*:*:node.js:*:*", "matchCriteriaId": "812CD7D7-E4D0-4121-BB4B-861AFE503215", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha16:*:*:*:node.js:*:*", "matchCriteriaId": "A9686411-3378-4786-9581-CAF7214C3482", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha17:*:*:*:node.js:*:*", "matchCriteriaId": "D5BAA8AC-6CC6-4B5E-A487-BC3665388CCF", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha18:*:*:*:node.js:*:*", "matchCriteriaId": "C96A930D-5799-4414-8146-466A207E7E30", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha19:*:*:*:node.js:*:*", "matchCriteriaId": "CB077789-E12B-46A3-B81F-4EA99A1DE9E9", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha2:*:*:*:node.js:*:*", "matchCriteriaId": "11C1FCFE-6D33-45F4-837D-26E9F01054C5", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha20:*:*:*:node.js:*:*", "matchCriteriaId": "200E06EA-A9AB-48E5-96D7-E4A8E33D29A4", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha21:*:*:*:node.js:*:*", "matchCriteriaId": "99D5280F-7737-4D4A-9342-2DB2BA95E229", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha22:*:*:*:node.js:*:*", "matchCriteriaId": "274221FB-AF14-47A7-87AE-93387A65C7B6", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha23:*:*:*:node.js:*:*", "matchCriteriaId": "018EF99F-F091-4D7B-9EB9-AF8E24D51846", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha24:*:*:*:node.js:*:*", "matchCriteriaId": "CADB1CC2-8821-4BC8-BDE0-F543A9CC1B26", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha25:*:*:*:node.js:*:*", "matchCriteriaId": "1891DDB0-64E4-4D4F-A8BB-4839DE3334E3", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha26:*:*:*:node.js:*:*", "matchCriteriaId": "61914E73-4231-4BBF-8BA3-542FE40DADD8", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha27:*:*:*:node.js:*:*", "matchCriteriaId": "EAE46D0A-5E3B-4DD7-B6BF-5F93E9193B21", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha28:*:*:*:node.js:*:*", "matchCriteriaId": "4CF57878-E430-4600-9B99-CC39BE38CDE1", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha29:*:*:*:node.js:*:*", "matchCriteriaId": "A12F9A7B-C5D0-444F-8422-58D1041AAE10", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha3:*:*:*:node.js:*:*", "matchCriteriaId": "C219A394-FB58-49C4-9EC1-50F5780B1F71", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha30:*:*:*:node.js:*:*", "matchCriteriaId": "A4BFB7F4-A2F6-43F8-9883-883F7B556419", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha31:*:*:*:node.js:*:*", "matchCriteriaId": "003CAEE4-938C-4B9B-9BD2-1894C2B3F2CA", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha32:*:*:*:node.js:*:*", "matchCriteriaId": "B7EE5788-DAC1-447A-872D-829B17C02FAA", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha33:*:*:*:node.js:*:*", "matchCriteriaId": "5B4DDFC3-21D9-447D-9777-5CF2D54C2303", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha34:*:*:*:node.js:*:*", "matchCriteriaId": "DB68E100-845B-4AD1-A9F6-F31BD98C5816", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha35:*:*:*:node.js:*:*", "matchCriteriaId": "F653F5C7-7F6F-476B-B435-4DB002B8FCE0", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha36:*:*:*:node.js:*:*", "matchCriteriaId": "1FE9FBDF-C5D0-429E-9D7B-515764392173", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha37:*:*:*:node.js:*:*", "matchCriteriaId": "9CC31EDA-E346-4512-B61D-459D1B7DF03F", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha38:*:*:*:node.js:*:*", "matchCriteriaId": "BD2D4595-10FD-4895-B022-975DFD5CE9EB", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha39:*:*:*:node.js:*:*", "matchCriteriaId": "8904600C-658B-4514-B466-723FEC00DC6C", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha4:*:*:*:node.js:*:*", "matchCriteriaId": "4CDC52FD-7C85-4208-A3A1-9F233206D002", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha40:*:*:*:node.js:*:*", "matchCriteriaId": "F833E1DE-406E-4933-BF58-51F130F351E7", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha41:*:*:*:node.js:*:*", "matchCriteriaId": "8637DC90-96F3-4BB3-8E99-1736E21F91BD", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha42:*:*:*:node.js:*:*", "matchCriteriaId": "5CA06430-8360-4DBE-B0DB-0D6FCD43B753", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha43:*:*:*:node.js:*:*", "matchCriteriaId": "13498595-56D9-47B9-A0CE-9D7C8C1BD8AD", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha5:*:*:*:node.js:*:*", "matchCriteriaId": "459F8862-2EFD-46AA-8D2D-D7750DFC843E", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha6:*:*:*:node.js:*:*", "matchCriteriaId": "85D6E3FE-A2D4-476B-AF63-75213CD55A9C", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha7:*:*:*:node.js:*:*", "matchCriteriaId": "33E7DDE6-F753-42B1-8F1C-4E9A7422AE09", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha8:*:*:*:node.js:*:*", "matchCriteriaId": "A40DD8A4-E9ED-437E-8BAC-A5119E982A7C", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha9:*:*:*:node.js:*:*", "matchCriteriaId": "DA4D845B-7B44-4F4A-93A5-A157D2E69408", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.4.0:alpha1:*:*:*:node.js:*:*", "matchCriteriaId": "C227B90E-83CD-4BF9-BB65-61C5FA3A8817", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.4.1:alpha1:*:*:*:node.js:*:*", "matchCriteriaId": "9AFC7739-810A-4D2A-9F00-30FA0E31D4FA", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.4.1:alpha2:*:*:*:node.js:*:*", "matchCriteriaId": "8CC23CD5-169B-4D16-A092-573299623DE3", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.5.0:alpha1:*:*:*:node.js:*:*", "matchCriteriaId": "9D47A3D8-F005-49CC-B83E-CA4BCC619663", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.5.0:alpha2:*:*:*:node.js:*:*", "matchCriteriaId": "54C60FCF-96EB-49D5-9A40-215D769403E6", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.5.0:alpha3:*:*:*:node.js:*:*", "matchCriteriaId": "BD4887CA-69F6-46F4-88E3-9ADF7965E48B", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.5.0:alpha4:*:*:*:node.js:*:*", "matchCriteriaId": "B3862636-438C-41B4-8643-3E7F30ADC425", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.5.0:alpha5:*:*:*:node.js:*:*", "matchCriteriaId": "6AB9AB22-C0EA-4988-9FB3-0F47B535FF99", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.5.0:alpha6:*:*:*:node.js:*:*", "matchCriteriaId": "CA6BE3E4-2C95-4C9A-84CF-2A979DF7DAA0", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.5.0:alpha7:*:*:*:node.js:*:*", "matchCriteriaId": "A650E481-B5B7-48C7-9E84-94B79A71701A", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:9.0.0:alpha1:*:*:*:node.js:*:*", "matchCriteriaId": "A264AC19-AE25-448D-9F18-20AE8163170B", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:9.0.0:alpha2:*:*:*:node.js:*:*", "matchCriteriaId": "C5EDF6CE-A994-4598-BB40-A1FBCB0C8D50", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:9.0.0:alpha3:*:*:*:node.js:*:*", "matchCriteriaId": "3AD71B52-42CB-4D07-A63B-028824213837", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:9.0.0:alpha4:*:*:*:node.js:*:*", "matchCriteriaId": "8AF361C5-6825-4921-B24C-E1D627D417EA", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:9.0.0:alpha5:*:*:*:node.js:*:*", "matchCriteriaId": "0A3BD430-B209-46AC-9944-2D59B0192CCA", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:9.0.0:alpha6:*:*:*:node.js:*:*", "matchCriteriaId": "713C7B39-2A07-4386-B46F-FF358EB36F57", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:9.0.0:alpha7:*:*:*:node.js:*:*", "matchCriteriaId": "59EF4AB1-6A2D-473A-A2DF-538CCC92F6A3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Parse Dashboard is a standalone dashboard for managing Parse Server apps. In versions 7.3.0-alpha.42 through 9.0.0-alpha.7, the AI Agent API endpoint (`POST /apps/:appId/agent`) lacks CSRF protection. An attacker can craft a malicious page that, when visited by an authenticated dashboard user, submits requests to the agent endpoint using the victim's session. The fix in version 9.0.0-alpha.8 adds CSRF middleware to the agent endpoint and embeds a CSRF token in the dashboard page. As a workaround, remove the `agent` configuration block from your dashboard configuration. Dashboards without an `agent` config are not affected."}, {"lang": "es", "value": "Parse Dashboard es un panel de control independiente para gestionar aplicaciones de Parse Server. En las versiones 7.3.0-alpha.42 hasta la 9.0.0-alpha.7, el endpoint de la API del Agente de IA ('POST /apps/:appId/agent') carece de protecci\u00f3n CSRF. Un atacante puede crear una p\u00e1gina maliciosa que, al ser visitada por un usuario autenticado del panel de control, env\u00eda solicitudes al endpoint del agente utilizando la sesi\u00f3n de la v\u00edctima. La correcci\u00f3n en la versi\u00f3n 9.0.0-alpha.8 a\u00f1ade middleware CSRF al endpoint del agente e incrusta un token CSRF en la p\u00e1gina del panel de control. Como soluci\u00f3n alternativa, elimine el bloque de configuraci\u00f3n 'agent' de su configuraci\u00f3n del panel de control. Los paneles de control sin una configuraci\u00f3n 'agent' no se ven afectados."}], "id": "CVE-2026-27609", "lastModified": "2026-06-26T17:00:03.350", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.3, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "HIGH", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27609", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-27T17:24:42.522909Z", "version": "2.0.3"}}]}, "published": "2026-02-25T03:16:05.120", "references": [{"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/parse-community/parse-dashboard/releases/tag/9.0.0-alpha.8"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/parse-community/parse-dashboard/security/advisories/GHSA-3534-xp88-25rc"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.3.0-alpha.42,9.0.0-alpha.8)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "parse-dashboard", "source": "cna", "vendor": "parse-community"}, "product": "parse_dashboard", "vendor": "parse_community"}], "analysis": {"en": {"generated_at": "2026-04-17T15:31:04.741854+00:00", "value": {"mitigation_remediation": ["Upgrade Parse Dashboard to version 9.0.0\u2011alpha.8 or later to apply CSRF protection", "If a version upgrade is not immediately feasible, remove the agent configuration block from the dashboard configuration file; dashboards that omit the agent block are not vulnerable", "Until a patch or configuration change is applied, block the POST /apps/:appId/agent endpoint at the network level using firewall rules or a reverse\u2011proxy to prevent unintended requests"], "summary": {"action": "Immediate Patch", "impact": "Remote code execution or privileged API access via CSRF on Parse Dashboard agent endpoint"}, "threat_synthesis": {"affected_systems": "The affected product is Parse\u00a0Dashboard from the parse\u2011community vendor. All releases from 7.3.0\u2011alpha.42 up to and including 9.0.0\u2011alpha.7 contain the flaw. Updates beginning with 9.0.0\u2011alpha.8 add CSRF middleware and are no longer susceptible.", "description_and_impact": "Parse Dashboard versions 7.3.0\u2011alpha.42 through 9.0.0\u2011alpha.7 expose the AI Agent API endpoint (POST\u00a0/apps/:appId/agent) without CSRF protection. An attacker can host a malicious web page that, when visited by an authenticated dashboard user, causes the victim\u2019s browser to issue agent requests using the user\u2019s session cookie. Because the agent endpoint can trigger privileged actions or execute code in the Parse Server environment, this flaw enables the attacker to compromise confidentiality, integrity, or availability of the hosted application. The vulnerability is classified as a Cross\u2011Site Request Forgery (CWE\u2011352) and carries a CVSS base score of 8.3.", "risk_and_exploitability": "The CVSS score of 8.3 indicates high impact, but the EPSS score is reported as less than 1\u202f%, suggesting a low current exploitation probability. The flaw is not listed in the CISA KEV catalog. Exploitation requires an authenticated user to interact with a crafted page, making it a user\u2011interaction CSRF scenario that can result in remote code execution or other high\u2011impact actions on the Parse Server."}}}}, "created": "2026-02-25T11:35:03.989338+00:00", "updated": "2026-04-17T15:45:15.883027+00:00", "vendors": ["parse_community", "parse_community$PRODUCT$parse_dashboard"]}