CVE-2026-27610
mediumPriorität · verfolgen · 21EPSS 0.005 · 39. PerzentilEUUSEPSS · bewertet 2026-10-23
Parse Dashboard is a standalone dashboard for managing Parse Server apps. In versions 7.3.0-alpha.42 through 9.0.0-alpha.7, the `ConfigKeyCache` uses the same cache key for both master key and read-only master key when resolving function-typed keys. Under specific timing conditions, a read-only user can receive the cached full master key, or a regular user can receive the cached read-only master key. The fix in version 9.0.0-alpha.8 uses distinct cache keys for master key and read-only master key. As a workaround, avoid using function-typed master keys, or remove the `agent` configuration block from your dashboard configuration.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · low–high · 3.8–7
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (15)
Betroffene Produkte und Versionsbereiche.
Advisories (1)
Hersteller- und Ökosystem-Meldungen dazu.
- GHSA-jhp4-jvq3-w5xrParse Dashboard Has a Cache Key Collision that Leaks Master Key to Read-Only Sessions2026-02-25ghsa · osvUS
### Impact The `ConfigKeyCache` uses the same cache key for both master key and read-only master key when resolving function-typed keys. Under specific timing conditions, a read-only user can receive the cached full master key, or a regular user can receive the cached read-only master key. ### Patches The fix uses distinct cache keys for master key and read-only master key. ### Workarounds Avoid using function-typed master keys, or remove the `agent` configuration block from your dashboard configuration. ### Resources - GitHub advisory: https://github.com/parse-community/parse-dashboard/security/advisories/GHSA-jhp4-jvq3-w5xr - Fixed in: https://github.com/parse-community/parse-dashboard/releases/tag/9.0.0-alpha.8
auch bekannt als (3)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (10)
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/parse-community/parse-dashboard/commit/f92a9ef5246d57e51696bd881a15f3b133b2bb50cnnvd
- https://github.com/parse-community/parse-dashboard/releases/Patchcnnvd
- https://github.com/parse-community/parse-dashboard/releases/tag/9.0.0-alpha.8cnnvd
- https://github.com/parse-community/parse-dashboard/security/advisories/GHSA-jhp4-jvq3-w5xrcnnvd
- https://github.com/parse-community/parse-dashboard/commit/f92a9ef5246d57e51696bd881a15f3b133b2bb50enisa_euvd
- https://github.com/parse-community/parse-dashboard/releases/tag/9.0.0-alpha.8enisa_euvd
- https://github.com/parse-community/parse-dashboard/security/advisories/GHSA-jhp4-jvq3-w5xrenisa_euvd
- https://github.com/parse-community/parse-dashboard/commit/f92a9ef5246d57e51696bd881a15f3b133b2bb50Patchnvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan