CVE-2026-27609 Parse Dashboard Missing CSRF Protection on Agent Endpoint

What is CVE-2026-27609?

CVE-2026-27609 is a high-severity vulnerability in parse-community parse-dashboard, published on 25 Feb 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Parse Dashboard is a standalone dashboard for managing Parse Server apps. In versions 7.3.0-alpha.42 through 9.0.0-alpha.7, the AI Agent API endpoint (`POST /apps/:appId/agent`) lacks CSRF protection. An attacker can craft a malicious page that, when visited by an authenticated dashboard user, submits requests to the agent endpoint using the victim's session. The fix in version 9.0.0-alpha.8 adds CSRF middleware to the agent endpoint and embeds a CSRF token in the dashboard page. As a workaround, remove the `agent` configuration block from your dashboard configuration. Dashboards without an `agent` config are not affected.

Weakness: CWE-352

Which versions are affected by CVE-2026-27609?

2 open source packages ship an affected version, including parse-dashboard. It affects 1 product.

Products include Parseplatform Parse Dashboard.

How do I fix CVE-2026-27609?

Upgrade parse-dashboard to 9.0.0-alpha.8 or later.

Is CVE-2026-27609 being exploited?

There is no known exploitation of CVE-2026-27609 in the wild and no public exploit code.

Other vulnerabilities in parse-community parse-dashboard

• CVE-2026-27595 Parse Dashboard has incomplete authentication on AI Agent endpoint Critical 9.9
• CVE-2026-27608 Parse Dashboard Missing Authorization on Agent Endpoint Critical 9.3
• CVE-2026-27610 Parse Dashboard Has a Cache Key Collision that Leaks Master Key to Read-Only Sessions High 7.0

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-3534-xp88-25rc.