CVE-2026-27609: Parse Dashboard Lacks CSRF Protection for Agent Endpoint
Summary
CVE-2026-27609: Parse Dashboard is Missing CSRF Protection for its Agent Endpoint. Affects parse-dashboard versions >= 7.3.0-alpha.42, < 9.0.0-alpha.8. Fixed in 9.0.0-alpha.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Parse Dashboard is an open-source web application that provides a user-friendly interface for managing Parse Server applications. It allows developers to view and manipulate data, manage users, and perform various administrative tasks. The dashboard is widely used in applications that utilize Parse Server, making it crucial for developers to ensure its security. This vulnerability exposes the agent endpoint to Cross-Site Request Forgery (CSRF) attacks, potentially compromising user sessions.
Vulnerability Detail
The vulnerability arises from the absence of CSRF protection on the AI Agent API endpoint (POST /apps/:appId/agent). An attacker can exploit this by crafting a malicious page that, when accessed by an authenticated user of the dashboard, can submit unauthorized requests to the agent endpoint using the victim's session. This can lead to unauthorized actions being performed on behalf of the user, posing significant security risks.
How To Fix
Latest published version: 9.2.0 as of 23 Oct 2026
npm install parse-dashboard@9.2.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
9.0.0-alpha.8
This is the first release that contains the fix.
npm install parse-dashboard@9.0.0-alpha.8Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can remove the 'agent' configuration block from your dashboard configuration. Dashboards without an 'agent' config are not affected by this vulnerability. Here’s an example of how to modify your configuration:
const dashboard = new ParseDashboard({
apps: [
{
appId: 'YOUR_APP_ID',
serverURL: 'YOUR_SERVER_URL',
// Remove the agent block
// agent: { ... }
}
]
});
Conclusion
The CSRF vulnerability in Parse Dashboard's agent endpoint poses significant risks to user accounts and data integrity. It is crucial for users of the dashboard to update to the latest version or implement the recommended workarounds to safeguard their applications.
See every vulnerability recorded for parse-dashboard →
FAQ
Cross-Site Request Forgery (CSRF) is a type of attack that tricks the victim into submitting a request that they did not intend to make, potentially compromising their account.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to test your application without signing up.
If exploited, this vulnerability can allow attackers to perform unauthorized actions on behalf of authenticated users, leading to data breaches or other malicious activities.
Yes, a patch is available in version 9.0.0-alpha.8 of the parse-dashboard package. It is recommended to update to this version to mitigate the vulnerability.
The CVSS score for this vulnerability is 8.3, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for parse-dashboard.
