Parse Dashboard Has a Cache Key Collision that Leaks Master Key to Read-Only Sessions

Parse Dashboard has a flaw where its cache system uses the same key for both full and read-only master keys, allowing a read-only user to accidentally receive the full master key under certain timing conditions. This compromises security by giving unauthorized access to sensitive administrative credentials.

The ConfigKeyCache in Parse Dashboard versions 7.3.0-alpha.42 through 9.0.0-alpha.7 fails to differentiate cache keys when resolving function-typed master keys, creating a collision vulnerability. Under race conditions, cache lookups can return the wrong credential type (master key instead of read-only key or vice versa), allowing privilege escalation and unauthorized administrative access.