{"data":{"id":"bc671db7-fc0d-4666-a644-ed37f90ecf08","title":"CVE-2026-27609: Parse Dashboard is a standalone dashboard for managing Parse Server apps. In versions 7.3.0-alpha.42 through…","summary":"Parse Dashboard, a standalone dashboard for managing Parse Server apps, lacks CSRF protection on its AI Agent API endpoint (`POST /apps/:appId/agent`) in versions 7.3.0-alpha.42 through 9.0.0-alpha.7. An attacker can host a malicious page that, when visited by an authenticated dashboard user, submits requests to that endpoint using the victim's session.","solution":"Fixed in 9.0.0-alpha.8, which adds CSRF middleware to the agent endpoint and embeds a CSRF token in the dashboard page. As a workaround, remove the `agent` configuration block from your dashboard configuration; dashboards without an `agent` config are not affected.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-27609","publishedAt":"2026-02-25T03:16:05.120Z","cveId":"CVE-2026-27609","cweIds":["CWE-352"],"cvssScore":null,"cvssSeverity":null,"severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":["parse-dashboard@>= 7.3.0-alpha.42, < 9.0.0-alpha.8 (fixed: 9.0.0-alpha.8)"],"affectedPackageNames":["parse-dashboard"],"affectedPackageRefs":["npm:parse-dashboard"],"affectedVendors":[],"affectedVendorsRaw":["Parse Dashboard","Parse Server","AI Agent API"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Parse Dashboard AI Agent API endpoint lacks CSRF protection","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00166,"epssCheckedAt":"2026-11-04T18:09:12.821Z","kevDateAdded":null,"advisoryAliases":["GHSA-3534-xp88-25rc"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:50:43.062Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2026-02-19T22:25:03.745Z","daysToFix":-6,"fixCheckedAt":"2026-10-29T21:40:36.898Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity"],"aiComponentTargeted":"agent","llmSpecific":false,"classifierConfidence":0.8,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"npm","name":"parse-dashboard","fixedVersion":"9.0.0-alpha.8","matchedVersion":"9.0.0-alpha.8","fixReleasedAt":"2026-02-19T22:25:03.745Z","daysToFix":-6,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:40:36.749Z"}]}}