CVE-2026-27610
mediumpriority · track · 21EPSS 0.005 · 39 %ileEUUSEPSS · scored 2026-10-23
Parse Dashboard is a standalone dashboard for managing Parse Server apps. In versions 7.3.0-alpha.42 through 9.0.0-alpha.7, the `ConfigKeyCache` uses the same cache key for both master key and read-only master key when resolving function-typed keys. Under specific timing conditions, a read-only user can receive the cached full master key, or a regular user can receive the cached read-only master key. The fix in version 9.0.0-alpha.8 uses distinct cache keys for master key and read-only master key. As a workaround, avoid using function-typed master keys, or remove the `agent` configuration block from your dashboard configuration.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–high · 3.8–7
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (15)
Products and version ranges known to be affected.
advisories (1)
Vendor and ecosystem advisories describing this.
- GHSA-jhp4-jvq3-w5xrParse Dashboard Has a Cache Key Collision that Leaks Master Key to Read-Only Sessions2026-02-25ghsa · osvUS
### Impact The `ConfigKeyCache` uses the same cache key for both master key and read-only master key when resolving function-typed keys. Under specific timing conditions, a read-only user can receive the cached full master key, or a regular user can receive the cached read-only master key. ### Patches The fix uses distinct cache keys for master key and read-only master key. ### Workarounds Avoid using function-typed master keys, or remove the `agent` configuration block from your dashboard configuration. ### Resources - GitHub advisory: https://github.com/parse-community/parse-dashboard/security/advisories/GHSA-jhp4-jvq3-w5xr - Fixed in: https://github.com/parse-community/parse-dashboard/releases/tag/9.0.0-alpha.8
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (10)
External citations — patches, advisories, analysis.
- https://github.com/parse-community/parse-dashboard/commit/f92a9ef5246d57e51696bd881a15f3b133b2bb50cnnvd
- https://github.com/parse-community/parse-dashboard/releases/Patchcnnvd
- https://github.com/parse-community/parse-dashboard/releases/tag/9.0.0-alpha.8cnnvd
- https://github.com/parse-community/parse-dashboard/security/advisories/GHSA-jhp4-jvq3-w5xrcnnvd
- https://github.com/parse-community/parse-dashboard/commit/f92a9ef5246d57e51696bd881a15f3b133b2bb50enisa_euvd
- https://github.com/parse-community/parse-dashboard/releases/tag/9.0.0-alpha.8enisa_euvd
- https://github.com/parse-community/parse-dashboard/security/advisories/GHSA-jhp4-jvq3-w5xrenisa_euvd
- https://github.com/parse-community/parse-dashboard/commit/f92a9ef5246d57e51696bd881a15f3b133b2bb50Patchnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan