CVE-2026-27609highCWE-352

CVE-2026-27609: falha de alta gravidade em parse-community parse-dashboard

Parse Dashboard Missing CSRF Protection on Agent Endpoint

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar parse-dashboard+ Monitorar parse-dashboard

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.3epss 0.2%
Parse Dashboard is a standalone dashboard for managing Parse Server apps. In versions 7.3.0-alpha.42 through 9.0.0-alpha.7, the AI Agent API endpoint (`POST /apps/:appId/agent`) lacks CSRF protection. An attacker can craft a malicious page that, when visited by an authenticated dashboard user, submits requests to the agent endpoint using the victim's session. The fix in version 9.0.0-alpha.8 adds CSRF middleware to the agent endpoint and embeds a CSRF token in the dashboard page. As a workaround, remove the `agent` configuration block from your dashboard configuration. Dashboards without an `agent` config are not affected.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N
Produtos afetados
parse-community · parse-dashboard
CVEs relacionadas — parse-community parse-dashboard

No mesmo produto, das mais perigosas para as menos.

CVE-2026-27595CRITICALParse Dashboard has incomplete authentication on AI Agent endpointEPSS 0.5%CVE-2026-27610HIGHParse Dashboard Has a Cache Key Collision that Leaks Master Key to Read-Only SessionsEPSS 0.4%CVE-2026-27608CRITICALParse Dashboard Missing Authorization on Agent EndpointEPSS 0.3%