CVE-2026-27610

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27610", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-20T19:43:14.602Z", "datePublished": "2026-02-25T02:19:56.022Z", "dateUpdated": "2026-02-27T17:24:10.098Z"}, "containers": {"cna": {"title": "Parse Dashboard Has a Cache Key Collision that Leaks Master Key to Read-Only Sessions", "problemTypes": [{"descriptions": [{"cweId": "CWE-1289", "lang": "en", "description": "CWE-1289: Improper Validation of Unsafe Equivalence in Input", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "baseScore": 7, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/parse-community/parse-dashboard/security/advisories/GHSA-jhp4-jvq3-w5xr", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/parse-community/parse-dashboard/security/advisories/GHSA-jhp4-jvq3-w5xr"}, {"name": "https://github.com/parse-community/parse-dashboard/commit/f92a9ef5246d57e51696bd881a15f3b133b2bb50", "tags": ["x_refsource_MISC"], "url": "https://github.com/parse-community/parse-dashboard/commit/f92a9ef5246d57e51696bd881a15f3b133b2bb50"}, {"name": "https://github.com/parse-community/parse-dashboard/releases/tag/9.0.0-alpha.8", "tags": ["x_refsource_MISC"], "url": "https://github.com/parse-community/parse-dashboard/releases/tag/9.0.0-alpha.8"}], "affected": [{"vendor": "parse-community", "product": "parse-dashboard", "versions": [{"version": ">= 7.3.0-alpha.42, < 9.0.0-alpha.8", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-25T02:21:23.731Z"}, "descriptions": [{"lang": "en", "value": "Parse Dashboard is a standalone dashboard for managing Parse Server apps. In versions 7.3.0-alpha.42 through 9.0.0-alpha.7, the `ConfigKeyCache` uses the same cache key for both master key and read-only master key when resolving function-typed keys. Under specific timing conditions, a read-only user can receive the cached full master key, or a regular user can receive the cached read-only master key. The fix in version 9.0.0-alpha.8 uses distinct cache keys for master key and read-only master key. As a workaround, avoid using function-typed master keys, or remove the `agent` configuration block from your dashboard configuration."}], "source": {"advisory": "GHSA-jhp4-jvq3-w5xr", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-27T17:24:01.878122Z", "id": "CVE-2026-27610", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-27T17:24:10.098Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27610", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-27T17:24:01.878122Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-27T17:24:06.227Z"}}], "cna": {"title": "Parse Dashboard Has a Cache Key Collision that Leaks Master Key to Read-Only Sessions", "source": {"advisory": "GHSA-jhp4-jvq3-w5xr", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "parse-community", "product": "parse-dashboard", "versions": [{"status": "affected", "version": ">= 7.3.0-alpha.42, < 9.0.0-alpha.8"}]}], "references": [{"url": "https://github.com/parse-community/parse-dashboard/security/advisories/GHSA-jhp4-jvq3-w5xr", "name": "https://github.com/parse-community/parse-dashboard/security/advisories/GHSA-jhp4-jvq3-w5xr", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/parse-community/parse-dashboard/commit/f92a9ef5246d57e51696bd881a15f3b133b2bb50", "name": "https://github.com/parse-community/parse-dashboard/commit/f92a9ef5246d57e51696bd881a15f3b133b2bb50", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/parse-community/parse-dashboard/releases/tag/9.0.0-alpha.8", "name": "https://github.com/parse-community/parse-dashboard/releases/tag/9.0.0-alpha.8", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Parse Dashboard is a standalone dashboard for managing Parse Server apps. In versions 7.3.0-alpha.42 through 9.0.0-alpha.7, the `ConfigKeyCache` uses the same cache key for both master key and read-only master key when resolving function-typed keys. Under specific timing conditions, a read-only user can receive the cached full master key, or a regular user can receive the cached read-only master key. The fix in version 9.0.0-alpha.8 uses distinct cache keys for master key and read-only master key. As a workaround, avoid using function-typed master keys, or remove the `agent` configuration block from your dashboard configuration."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1289", "description": "CWE-1289: Improper Validation of Unsafe Equivalence in Input"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-25T02:21:23.731Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27610", "state": "PUBLISHED", "dateUpdated": "2026-02-27T17:24:10.098Z", "dateReserved": "2026-02-20T19:43:14.602Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-25T02:19:56.022Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "parse-dashboard", "vendor": "parse-community", "versions": [{"status": "affected", "version": ">= 7.3.0-alpha.42, < 9.0.0-alpha.8"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.3.0:alpha42:*:*:*:node.js:*:*", "matchCriteriaId": "07E54A25-BB5E-4E4F-B3EC-0B9979CC067D", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.3.0:alpha43:*:*:*:node.js:*:*", "matchCriteriaId": "C8E605D1-F9FB-4AB4-9FFA-211F01496FEB", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.3.0:alpha44:*:*:*:node.js:*:*", "matchCriteriaId": "0E68DA89-5409-4F06-A69A-7C4672D10521", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.3.0:alpha5:*:*:*:node.js:*:*", "matchCriteriaId": "F41426EE-2CD5-4E74-A4D0-1B3BA49A9481", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.3.0:alpha6:*:*:*:node.js:*:*", "matchCriteriaId": "97BF4F76-319D-4DE8-A6E4-A8F08D384C59", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.3.0:alpha7:*:*:*:node.js:*:*", "matchCriteriaId": "83A19B88-2B7B-4C19-ABC9-AB01574608D2", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.3.0:alpha8:*:*:*:node.js:*:*", "matchCriteriaId": "B96B7FF8-7BF6-48B8-9887-EA7D9327DF35", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.3.0:alpha9:*:*:*:node.js:*:*", "matchCriteriaId": "014B82A6-F7D9-4B05-8D36-31781D177D9D", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.4.0:alpha1:*:*:*:node.js:*:*", "matchCriteriaId": "E6B6F40D-5FD8-4EF9-9AE9-DCA471C5CAFC", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.4.0:alpha2:*:*:*:node.js:*:*", "matchCriteriaId": "04966183-2013-4AC5-95C0-C3536AE97D3F", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.4.0:alpha3:*:*:*:node.js:*:*", "matchCriteriaId": "00572EFD-7E41-42D9-8412-0C25F9AAABE8", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.4.0:alpha4:*:*:*:node.js:*:*", "matchCriteriaId": "E444707A-C905-485C-8CDB-AE3B8780C56A", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.4.0:alpha5:*:*:*:node.js:*:*", "matchCriteriaId": "49327FD3-E9B0-4245-8126-EF44DDE6EB17", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.5.0:alpha1:*:*:*:node.js:*:*", "matchCriteriaId": "F068BEBE-FF4F-45BA-A3ED-C1A4E6ACA2FF", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.5.0:alpha2:*:*:*:node.js:*:*", "matchCriteriaId": "819B012F-E02A-4E7E-8935-F534270F8A80", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.6.0:alpha1:*:*:*:node.js:*:*", "matchCriteriaId": "25C0D991-B416-4BC1-882A-61FFB3E815CB", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.6.0:alpha10:*:*:*:node.js:*:*", "matchCriteriaId": "44D86A4C-7105-42BE-82B3-15736D0C7164", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.6.0:alpha11:*:*:*:node.js:*:*", "matchCriteriaId": "8EFB3F3E-4F2F-4975-8B5D-CC6E17489386", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.6.0:alpha12:*:*:*:node.js:*:*", "matchCriteriaId": "BADD19AE-F281-4222-B7BE-535EC4045F4B", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.6.0:alpha13:*:*:*:node.js:*:*", "matchCriteriaId": "EB952B96-D2A1-4706-8054-C3DB72388E49", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.6.0:alpha2:*:*:*:node.js:*:*", "matchCriteriaId": "B867C0D1-DB8B-44E9-B147-F92A74BF0B98", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.6.0:alpha3:*:*:*:node.js:*:*", "matchCriteriaId": "5AE07136-83B7-4DE5-9F90-3C3B11E0AF78", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.6.0:alpha4:*:*:*:node.js:*:*", "matchCriteriaId": "5EA360CA-BFAB-4CDE-AD59-CC10F5D0601B", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.6.0:alpha5:*:*:*:node.js:*:*", "matchCriteriaId": "0471F4A9-2DF0-429E-86BA-267F8DA92319", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.6.0:alpha6:*:*:*:node.js:*:*", "matchCriteriaId": "74421939-B72D-41DA-A276-2137C8D87A3C", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.6.0:alpha7:*:*:*:node.js:*:*", "matchCriteriaId": "620A6F14-7697-4B03-A116-6E54DD6DD806", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.6.0:alpha8:*:*:*:node.js:*:*", "matchCriteriaId": "6959259A-2208-42B9-8FD4-65BB60F8A355", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.6.0:alpha9:*:*:*:node.js:*:*", "matchCriteriaId": "F1E70933-B30D-493C-A8BA-20FA873E3AFD", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.0.0:alpha1:*:*:*:node.js:*:*", "matchCriteriaId": "59953623-4467-4BF8-916D-7FAF85E7B112", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.0.0:alpha2:*:*:*:node.js:*:*", "matchCriteriaId": "006F6095-1A9A-4418-B7A3-9040823B6D0E", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.0.0:alpha3:*:*:*:node.js:*:*", "matchCriteriaId": "A7902611-FAC7-43A6-A86A-0B6D232EE3F8", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.0.0:alpha4:*:*:*:node.js:*:*", "matchCriteriaId": "ACC8F371-7DA0-4269-9080-3CCEF0F193FF", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.0.0:alpha5:*:*:*:node.js:*:*", "matchCriteriaId": "E7835681-3581-4834-B6F1-0F48CD5231F4", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.0.0:alpha6:*:*:*:node.js:*:*", "matchCriteriaId": "4760B32F-6943-4BC6-9893-ECE12839291D", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.1.0:alpha1:*:*:*:node.js:*:*", "matchCriteriaId": "F1598567-50D0-4D26-9B60-6067E8070D9B", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.1.0:alpha10:*:*:*:node.js:*:*", "matchCriteriaId": "02CDB7B1-5CD7-402D-ACDA-CFD5DCCA1455", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.1.0:alpha11:*:*:*:node.js:*:*", "matchCriteriaId": "4E461A18-5EB0-4E9E-9670-82B2ABF568F4", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.1.0:alpha12:*:*:*:node.js:*:*", "matchCriteriaId": "794EE02E-6D86-4E4D-9F00-443BFFB78C54", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.1.0:alpha13:*:*:*:node.js:*:*", "matchCriteriaId": "6120C309-768A-4477-BF34-0AD21A104A19", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.1.0:alpha2:*:*:*:node.js:*:*", "matchCriteriaId": "4314A7D2-5CA8-4081-BF2B-88A7175B14FE", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.1.0:alpha3:*:*:*:node.js:*:*", "matchCriteriaId": "A222119F-5962-49E2-94B5-C3BBC8B19584", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.1.0:alpha4:*:*:*:node.js:*:*", "matchCriteriaId": "7F8A9B5B-A1CE-4C86-A031-E638FDEAFE8A", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.1.0:alpha5:*:*:*:node.js:*:*", "matchCriteriaId": "D5365B15-3725-4E8B-A0BA-2D4513706AEC", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.1.0:alpha6:*:*:*:node.js:*:*", "matchCriteriaId": "CEE8CA47-2A8A-44F4-8ABC-C899DA12A49C", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.1.0:alpha7:*:*:*:node.js:*:*", "matchCriteriaId": "B4065C00-6E46-4B19-B32F-9A485EF9AAB4", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.1.0:alpha8:*:*:*:node.js:*:*", "matchCriteriaId": "E6A9E323-7A79-4068-A596-826DB8393273", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.1.0:alpha9:*:*:*:node.js:*:*", "matchCriteriaId": "F07743D3-82D8-425E-918E-D689DFF5B456", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.1.1:alpha1:*:*:*:node.js:*:*", "matchCriteriaId": "77DE8253-E642-4247-8AD7-444C658C11B7", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha1:*:*:*:node.js:*:*", "matchCriteriaId": "45558A90-0C09-485F-BC7A-DC7403AADA9F", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha10:*:*:*:node.js:*:*", "matchCriteriaId": "147EA8FF-8CCD-442C-A9AF-B3B413AC08AD", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha11:*:*:*:node.js:*:*", "matchCriteriaId": "DE95BEF0-E579-4EAF-BC5D-49C6A097A029", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha12:*:*:*:node.js:*:*", "matchCriteriaId": "B9C9BAF7-52AA-4117-9EB9-15B23625BB4A", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha13:*:*:*:node.js:*:*", "matchCriteriaId": "751EF4D4-017A-40E6-A4DA-73CE3E6E6F18", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha14:*:*:*:node.js:*:*", "matchCriteriaId": "909CEA7C-20A0-4E59-80CA-ECED455AB0A4", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha15:*:*:*:node.js:*:*", "matchCriteriaId": "9CDE7AA9-E25F-4614-8824-75BD61137383", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha16:*:*:*:node.js:*:*", "matchCriteriaId": "62F4B0D7-F3C2-4279-97D7-027FA84A69D0", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha17:*:*:*:node.js:*:*", "matchCriteriaId": "AB00F9FE-2BC9-4DDC-90EC-BB4E344D7FAE", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha18:*:*:*:node.js:*:*", "matchCriteriaId": "F747C7B3-7B22-4977-ACA6-A61A72966EBA", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha19:*:*:*:node.js:*:*", "matchCriteriaId": "CFA065EB-17EF-4BDC-90C3-7612DA0BAEE3", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha2:*:*:*:node.js:*:*", "matchCriteriaId": "3D063244-3964-4538-BD71-444C4AC78159", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha20:*:*:*:node.js:*:*", "matchCriteriaId": "14F2E6D0-BF45-44C6-B09E-BBCB0D9A5B9D", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha21:*:*:*:node.js:*:*", "matchCriteriaId": "A035B1BF-8A6E-43BD-B497-5880069DE701", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha22:*:*:*:node.js:*:*", "matchCriteriaId": "EA0EF875-506C-41F6-9982-C615BD7F736A", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha23:*:*:*:node.js:*:*", "matchCriteriaId": "C685FFA6-8C20-4E45-8C8F-7CAE843272E7", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha24:*:*:*:node.js:*:*", "matchCriteriaId": "E5069E97-CAAC-4609-A679-D9ED85E46183", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha25:*:*:*:node.js:*:*", "matchCriteriaId": "0A3896DE-2FEE-4745-93D4-20B94CF821B0", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha26:*:*:*:node.js:*:*", "matchCriteriaId": "12BB3FFA-33B6-46DA-B128-41F1B569EEDA", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha27:*:*:*:node.js:*:*", "matchCriteriaId": "1BEA50F8-8F8C-4CF2-A0D2-83FE4A417984", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha3:*:*:*:node.js:*:*", "matchCriteriaId": "68AAA2B1-BCFA-47B5-B340-CD7B182EE0DD", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha4:*:*:*:node.js:*:*", "matchCriteriaId": "FB746E76-8E6D-4AA1-9E41-8B621F6B0817", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha5:*:*:*:node.js:*:*", "matchCriteriaId": "8606D8A6-3670-4C7A-89C0-C79B47DAE462", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha6:*:*:*:node.js:*:*", "matchCriteriaId": "AC53D1E9-E4DE-47BD-961A-AE3B201E6D9B", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha7:*:*:*:node.js:*:*", "matchCriteriaId": "11921795-B289-49B8-9B13-9E4D092DAD1D", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha8:*:*:*:node.js:*:*", "matchCriteriaId": "C9CC23DE-F84D-48F3-9474-65B240B4A773", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha9:*:*:*:node.js:*:*", "matchCriteriaId": "4D0E3EE7-57AD-469E-8C16-58A797413D09", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha1:*:*:*:node.js:*:*", "matchCriteriaId": "6E8CFB57-3235-48EF-85AA-6F93F75DBFFE", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha10:*:*:*:node.js:*:*", "matchCriteriaId": "298D7F20-184C-4D46-9BD0-952A5238CE38", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha11:*:*:*:node.js:*:*", "matchCriteriaId": "4EDA824F-BDD0-45CF-8707-90152F0DC8A5", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha12:*:*:*:node.js:*:*", "matchCriteriaId": "EFC686E3-4ACA-4DCE-8619-872A1D5A00E6", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha13:*:*:*:node.js:*:*", "matchCriteriaId": "62C667AB-C243-4EE5-A11F-903548659361", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha14:*:*:*:node.js:*:*", "matchCriteriaId": "BE5FFADF-61A9-4020-A440-A87513F8D16E", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha15:*:*:*:node.js:*:*", "matchCriteriaId": "812CD7D7-E4D0-4121-BB4B-861AFE503215", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha16:*:*:*:node.js:*:*", "matchCriteriaId": "A9686411-3378-4786-9581-CAF7214C3482", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha17:*:*:*:node.js:*:*", "matchCriteriaId": "D5BAA8AC-6CC6-4B5E-A487-BC3665388CCF", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha18:*:*:*:node.js:*:*", "matchCriteriaId": "C96A930D-5799-4414-8146-466A207E7E30", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha19:*:*:*:node.js:*:*", "matchCriteriaId": "CB077789-E12B-46A3-B81F-4EA99A1DE9E9", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha2:*:*:*:node.js:*:*", "matchCriteriaId": "11C1FCFE-6D33-45F4-837D-26E9F01054C5", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha20:*:*:*:node.js:*:*", "matchCriteriaId": "200E06EA-A9AB-48E5-96D7-E4A8E33D29A4", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha21:*:*:*:node.js:*:*", "matchCriteriaId": "99D5280F-7737-4D4A-9342-2DB2BA95E229", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha22:*:*:*:node.js:*:*", "matchCriteriaId": "274221FB-AF14-47A7-87AE-93387A65C7B6", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha23:*:*:*:node.js:*:*", "matchCriteriaId": "018EF99F-F091-4D7B-9EB9-AF8E24D51846", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha24:*:*:*:node.js:*:*", "matchCriteriaId": "CADB1CC2-8821-4BC8-BDE0-F543A9CC1B26", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha25:*:*:*:node.js:*:*", "matchCriteriaId": "1891DDB0-64E4-4D4F-A8BB-4839DE3334E3", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha26:*:*:*:node.js:*:*", "matchCriteriaId": "61914E73-4231-4BBF-8BA3-542FE40DADD8", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha27:*:*:*:node.js:*:*", "matchCriteriaId": "EAE46D0A-5E3B-4DD7-B6BF-5F93E9193B21", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha28:*:*:*:node.js:*:*", "matchCriteriaId": "4CF57878-E430-4600-9B99-CC39BE38CDE1", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha29:*:*:*:node.js:*:*", "matchCriteriaId": "A12F9A7B-C5D0-444F-8422-58D1041AAE10", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha3:*:*:*:node.js:*:*", "matchCriteriaId": "C219A394-FB58-49C4-9EC1-50F5780B1F71", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha30:*:*:*:node.js:*:*", "matchCriteriaId": "A4BFB7F4-A2F6-43F8-9883-883F7B556419", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha31:*:*:*:node.js:*:*", "matchCriteriaId": "003CAEE4-938C-4B9B-9BD2-1894C2B3F2CA", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha32:*:*:*:node.js:*:*", "matchCriteriaId": "B7EE5788-DAC1-447A-872D-829B17C02FAA", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha33:*:*:*:node.js:*:*", "matchCriteriaId": "5B4DDFC3-21D9-447D-9777-5CF2D54C2303", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha34:*:*:*:node.js:*:*", "matchCriteriaId": "DB68E100-845B-4AD1-A9F6-F31BD98C5816", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha35:*:*:*:node.js:*:*", "matchCriteriaId": "F653F5C7-7F6F-476B-B435-4DB002B8FCE0", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha36:*:*:*:node.js:*:*", "matchCriteriaId": "1FE9FBDF-C5D0-429E-9D7B-515764392173", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha37:*:*:*:node.js:*:*", "matchCriteriaId": "9CC31EDA-E346-4512-B61D-459D1B7DF03F", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha38:*:*:*:node.js:*:*", "matchCriteriaId": "BD2D4595-10FD-4895-B022-975DFD5CE9EB", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha39:*:*:*:node.js:*:*", "matchCriteriaId": "8904600C-658B-4514-B466-723FEC00DC6C", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha4:*:*:*:node.js:*:*", "matchCriteriaId": "4CDC52FD-7C85-4208-A3A1-9F233206D002", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha40:*:*:*:node.js:*:*", "matchCriteriaId": "F833E1DE-406E-4933-BF58-51F130F351E7", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha41:*:*:*:node.js:*:*", "matchCriteriaId": "8637DC90-96F3-4BB3-8E99-1736E21F91BD", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha42:*:*:*:node.js:*:*", "matchCriteriaId": "5CA06430-8360-4DBE-B0DB-0D6FCD43B753", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha43:*:*:*:node.js:*:*", "matchCriteriaId": "13498595-56D9-47B9-A0CE-9D7C8C1BD8AD", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha5:*:*:*:node.js:*:*", "matchCriteriaId": "459F8862-2EFD-46AA-8D2D-D7750DFC843E", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha6:*:*:*:node.js:*:*", "matchCriteriaId": "85D6E3FE-A2D4-476B-AF63-75213CD55A9C", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha7:*:*:*:node.js:*:*", "matchCriteriaId": "33E7DDE6-F753-42B1-8F1C-4E9A7422AE09", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha8:*:*:*:node.js:*:*", "matchCriteriaId": "A40DD8A4-E9ED-437E-8BAC-A5119E982A7C", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha9:*:*:*:node.js:*:*", "matchCriteriaId": "DA4D845B-7B44-4F4A-93A5-A157D2E69408", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.4.0:alpha1:*:*:*:node.js:*:*", "matchCriteriaId": "C227B90E-83CD-4BF9-BB65-61C5FA3A8817", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.4.1:alpha1:*:*:*:node.js:*:*", "matchCriteriaId": "9AFC7739-810A-4D2A-9F00-30FA0E31D4FA", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.4.1:alpha2:*:*:*:node.js:*:*", "matchCriteriaId": "8CC23CD5-169B-4D16-A092-573299623DE3", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.5.0:alpha1:*:*:*:node.js:*:*", "matchCriteriaId": "9D47A3D8-F005-49CC-B83E-CA4BCC619663", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.5.0:alpha2:*:*:*:node.js:*:*", "matchCriteriaId": "54C60FCF-96EB-49D5-9A40-215D769403E6", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.5.0:alpha3:*:*:*:node.js:*:*", "matchCriteriaId": "BD4887CA-69F6-46F4-88E3-9ADF7965E48B", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.5.0:alpha4:*:*:*:node.js:*:*", "matchCriteriaId": "B3862636-438C-41B4-8643-3E7F30ADC425", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.5.0:alpha5:*:*:*:node.js:*:*", "matchCriteriaId": "6AB9AB22-C0EA-4988-9FB3-0F47B535FF99", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.5.0:alpha6:*:*:*:node.js:*:*", "matchCriteriaId": "CA6BE3E4-2C95-4C9A-84CF-2A979DF7DAA0", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.5.0:alpha7:*:*:*:node.js:*:*", "matchCriteriaId": "A650E481-B5B7-48C7-9E84-94B79A71701A", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:9.0.0:alpha1:*:*:*:node.js:*:*", "matchCriteriaId": "A264AC19-AE25-448D-9F18-20AE8163170B", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:9.0.0:alpha2:*:*:*:node.js:*:*", "matchCriteriaId": "C5EDF6CE-A994-4598-BB40-A1FBCB0C8D50", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:9.0.0:alpha3:*:*:*:node.js:*:*", "matchCriteriaId": "3AD71B52-42CB-4D07-A63B-028824213837", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:9.0.0:alpha4:*:*:*:node.js:*:*", "matchCriteriaId": "8AF361C5-6825-4921-B24C-E1D627D417EA", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:9.0.0:alpha5:*:*:*:node.js:*:*", "matchCriteriaId": "0A3BD430-B209-46AC-9944-2D59B0192CCA", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:9.0.0:alpha6:*:*:*:node.js:*:*", "matchCriteriaId": "713C7B39-2A07-4386-B46F-FF358EB36F57", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:9.0.0:alpha7:*:*:*:node.js:*:*", "matchCriteriaId": "59EF4AB1-6A2D-473A-A2DF-538CCC92F6A3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Parse Dashboard is a standalone dashboard for managing Parse Server apps. In versions 7.3.0-alpha.42 through 9.0.0-alpha.7, the `ConfigKeyCache` uses the same cache key for both master key and read-only master key when resolving function-typed keys. Under specific timing conditions, a read-only user can receive the cached full master key, or a regular user can receive the cached read-only master key. The fix in version 9.0.0-alpha.8 uses distinct cache keys for master key and read-only master key. As a workaround, avoid using function-typed master keys, or remove the `agent` configuration block from your dashboard configuration."}, {"lang": "es", "value": "Parse Dashboard es un panel de control independiente para gestionar aplicaciones de Parse Server. En las versiones 7.3.0-alpha.42 hasta la 9.0.0-alpha.7, el `ConfigKeyCache` utiliza la misma clave de cach\u00e9 tanto para la clave maestra como para la clave maestra de solo lectura al resolver claves de tipo funci\u00f3n. Bajo condiciones de tiempo espec\u00edficas, un usuario de solo lectura puede recibir la clave maestra completa en cach\u00e9, o un usuario regular puede recibir la clave maestra de solo lectura en cach\u00e9. La correcci\u00f3n en la versi\u00f3n 9.0.0-alpha.8 utiliza claves de cach\u00e9 distintas para la clave maestra y la clave maestra de solo lectura. Como soluci\u00f3n alternativa, evite usar claves maestras de tipo funci\u00f3n, o elimine el bloque de configuraci\u00f3n `agent` de la configuraci\u00f3n de su panel de control."}], "id": "CVE-2026-27610", "lastModified": "2026-06-26T16:59:57.737", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27610", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-27T17:24:01.878122Z", "version": "2.0.3"}}]}, "published": "2026-02-25T03:16:05.297", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/parse-community/parse-dashboard/commit/f92a9ef5246d57e51696bd881a15f3b133b2bb50"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/parse-community/parse-dashboard/releases/tag/9.0.0-alpha.8"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/parse-community/parse-dashboard/security/advisories/GHSA-jhp4-jvq3-w5xr"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1289"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.3.0-alpha.42,9.0.0-alpha.8)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "parse-dashboard", "source": "cna", "vendor": "parse-community"}, "product": "parse_dashboard", "vendor": "parse_community"}], "analysis": {"en": {"generated_at": "2026-04-16T16:18:10.102561+00:00", "value": {"mitigation_remediation": ["Upgrade Parse Dashboard to version 9.0.0\u2011alpha.8 or later, where distinct cache keys are employed.", "If upgrading is not immediately possible, avoid using function\u2011typed master keys in the configuration and remove any 'agent' block from the dashboard configuration.", "After applying a fix or workaround, re\u2011evaluate access controls to ensure that read\u2011only users cannot perform privileged operations, and consider temporarily revoking read\u2011only accounts until the update can be deployed."], "summary": {"action": "Patch Immediately", "impact": "Privilege Escalation"}, "threat_synthesis": {"affected_systems": "Parse Dashboard, a standalone interface for Parse Server applications, is affected. Vendors: parse-community; product: parse-dashboard. All releases from 7.3.0\u2011alpha.42 through 9.0.0\u2011alpha.7 are vulnerable. These include numerous pre\u2011release alpha builds spanning versions 7.x to 9.x as enumerated in the CPE list.", "description_and_impact": "The vulnerability arises from a cache key collision in the ConfigKeyCache component of Parse Dashboard, causing master key material to be stored and subsequently retrieved under an incorrectly shared cache key. Under certain timing conditions, a read\u2011only user can retrieve the full master key, and a regular user can obtain the read\u2011only master key. The exposure enables an attacker to elevate privileges or gain unrestricted access to data, effectively turning a low\u2011privilege session into an administrative one.", "risk_and_exploitability": "The vulnerability carries a CVSS score of 7, indicating high severity, but the EPSS score is below 1\u202f%, suggesting very low exploitation probability at present. It is not listed in the KEV catalog, so there is no known widespread exploitation. A potential attacker needs read\u2011only access to the dashboard and must trigger the concurrent cache usage that leads to the collision; the attack vector would be via authenticated but low\u2011privilege sessions, likely requiring specific timing or concurrent requests. The impact is significant if successfully exploited."}}}}, "created": "2026-02-25T11:35:03.074288+00:00", "updated": "2026-04-16T16:30:15.925396+00:00", "vendors": ["parse_community", "parse_community$PRODUCT$parse_dashboard"]}