# CVE-2026-27610: Parse Platform Parse Dashboard privilege escalation in ConfigKeyCache

Source: https://junglewise.ai/threats/cve-2026-27610-parse-platform-parse-dashboard-privilege-escalation-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-25. Updated: 2026-06-26  
License: CC BY 4.0 with a link back

CVE-2026-27610 · Severity: medium · CVSS 5.3 · Published 2026-02-25

Parse Dashboard, a management interface for Parse Server applications, contains a security flaw that could allow users with restricted access to gain full administrative control. Due to a technical error in how the system remembers security keys, a read-only user might accidentally be granted the 'master key' under specific timing conditions. This could allow an unauthorized person to modify or delete sensitive application data and bypass intended security restrictions.

Technologies: [parse-dashboard (npm)](https://junglewise.ai/threats/technologies/parse-dashboard). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-27610 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-27610 being exploited in the wild.

**How severe is CVE-2026-27610?** Medium severity, with a CVSS score of 5.3, published 25 February 2026.

**Which products and versions are affected?** parse-dashboard (npm) SEMVER:introduced=7.3.0-alpha.42,fixed=9.0.0-alpha.8.

**Is there a fix for CVE-2026-27610?** Yes. parse-dashboard (npm): upgrade to 9.0.0-alpha.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-27610 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-27610?** Check whether you run parse-dashboard (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- parse-dashboard (npm): upgrade to 9.0.0-alpha.8 or later

  ```sh
  npm install parse-dashboard@9.0.0-alpha.8
  ```


## Technical details

A cache key collision vulnerability exists in Parse Dashboard's ConfigKeyCache component. When resolving function-typed keys, the system fails to differentiate between the full master key and the read-only master key in its cache storage. An attacker with low-privileged (read-only) access can exploit specific timing conditions to retrieve the cached full master key, leading to unauthorized integrity impact on the underlying Parse Server. The vulnerability is present when function-typed master keys are used or when the 'agent' configuration block is active. A fix is available in version 9.0.0-alpha.8 which implements distinct cache keys.

## Affected products

- Parse Platform Parse Dashboard 7.3.0-alpha.42 through 9.0.0-alpha.7

## Identifiers

- CVE-2026-27610
- GHSA-jhp4-jvq3-w5xr

## Timeline

- 2026-02-19: patched: Version 9.0.0-alpha.8 released
- 2026-02-23: advisory: GitHub Advisory GHSA-jhp4-jvq3-w5xr published
- 2026-02-25: disclosed: CVE-2026-27610 published to NVD

## References

- [https://github.com/parse-community/parse-dashboard/commit/f92a9ef5246d57e51696bd881a15f3b133b2bb50](https://github.com/parse-community/parse-dashboard/commit/f92a9ef5246d57e51696bd881a15f3b133b2bb50)
- [https://github.com/parse-community/parse-dashboard/releases/tag/9.0.0-alpha.8](https://github.com/parse-community/parse-dashboard/releases/tag/9.0.0-alpha.8)
- [https://github.com/parse-community/parse-dashboard/security/advisories/GHSA-jhp4-jvq3-w5xr](https://github.com/parse-community/parse-dashboard/security/advisories/GHSA-jhp4-jvq3-w5xr)

## Related threats

- [Parse Community Parse Dashboard CSRF in AI Agent API](https://junglewise.ai/threats/cve-2026-27609-parse-community-parse-dashboard-csrf-in-ai-agent-api)
- [Parse Dashboard missing authorization in AI Agent API](https://junglewise.ai/threats/cve-2026-27608-parse-dashboard-missing-authorization-in-ai-agent-api)
- [Parse Dashboard authentication bypass in AI Agent API](https://junglewise.ai/threats/cve-2026-27595-parse-dashboard-authentication-bypass-in-ai-agent-api)