Executive brief
Parse Dashboard, a management interface for Parse Server applications, contains a security flaw that could allow users with restricted access to gain full administrative control. Due to a technical error in how the system remembers security keys, a read-only user might accidentally be granted the 'master key' under specific timing conditions. This could allow an unauthorized person to modify or delete sensitive application data and bypass intended security restrictions.
Technical details
A cache key collision vulnerability exists in Parse Dashboard's ConfigKeyCache component. When resolving function-typed keys, the system fails to differentiate between the full master key and the read-only master key in its cache storage. An attacker with low-privileged (read-only) access can exploit specific timing conditions to retrieve the cached full master key, leading to unauthorized integrity impact on the underlying Parse Server. The vulnerability is present when function-typed master keys are used or when the 'agent' configuration block is active. A fix is available in version 9.0.0-alpha.8 which implements distinct cache keys.
Affected products
- Parse Platform Parse Dashboard 7.3.0-alpha.42 through 9.0.0-alpha.7
Timeline
- 2026-02-19: patched: Version 9.0.0-alpha.8 released
- 2026-02-23: advisory: GitHub Advisory GHSA-jhp4-jvq3-w5xr published
- 2026-02-25: disclosed: CVE-2026-27610 published to NVD