CVE-2026-27609

parseplatform parse dashboard

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2026-27609

Katalog CVE

CVSS 6.5 · Medium EPSS 0,18%

Kerentanan Cross-Site Request Forgery (CSRF) pada parseplatform parse dashboard. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

Parse Dashboard is a standalone dashboard for managing Parse Server apps. In versions 7.3.0-alpha.42 through 9.0.0-alpha.7, the AI Agent API endpoint (`POST /apps/:appId/agent`) lacks CSRF protection. An attacker can craft a malicious page that, when visited by an authenticated dashboard user, submits requests to the agent endpoint using the victim's session. The fix in version 9.0.0-alpha.8 adds CSRF middleware to the agent endpoint and embeds a CSRF token in the dashboard page. As a workaround, remove the `agent` configuration block from your dashboard configuration. Dashboards without an `agent` config are not affected.

Rincian

Terbit di NVD
25 Februari 2026
Terakhir diubah
26 Juni 2026
Status NVD
Analyzed
CVSS 3.1
6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-352: Cross-Site Request Forgery (CSRF)
EPSS (30 hari)
0,18% peluang dieksploitasi; lebih tinggi dari 7,0% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
parseplatform parse dashboard Versi 7.3.0 alpha42
parseplatform parse dashboard Versi 7.3.0 alpha43
parseplatform parse dashboard Versi 7.3.0 alpha44
parseplatform parse dashboard Versi 7.3.0 alpha5
parseplatform parse dashboard Versi 7.3.0 alpha6
parseplatform parse dashboard Versi 7.3.0 alpha7
parseplatform parse dashboard Versi 7.3.0 alpha8
parseplatform parse dashboard Versi 7.3.0 alpha9
parseplatform parse dashboard Versi 7.4.0 alpha1
parseplatform parse dashboard Versi 7.4.0 alpha2
parseplatform parse dashboard Versi 7.4.0 alpha3
parseplatform parse dashboard Versi 7.4.0 alpha4
parseplatform parse dashboard Versi 7.4.0 alpha5
parseplatform parse dashboard Versi 7.5.0 alpha1
parseplatform parse dashboard Versi 7.5.0 alpha2
parseplatform parse dashboard Versi 7.6.0 alpha1
parseplatform parse dashboard Versi 7.6.0 alpha10
parseplatform parse dashboard Versi 7.6.0 alpha11
parseplatform parse dashboard Versi 7.6.0 alpha12
parseplatform parse dashboard Versi 7.6.0 alpha13
parseplatform parse dashboard Versi 7.6.0 alpha2
parseplatform parse dashboard Versi 7.6.0 alpha3
parseplatform parse dashboard Versi 7.6.0 alpha4
parseplatform parse dashboard Versi 7.6.0 alpha5
parseplatform parse dashboard Versi 7.6.0 alpha6
parseplatform parse dashboard Versi 7.6.0 alpha7
parseplatform parse dashboard Versi 7.6.0 alpha8
parseplatform parse dashboard Versi 7.6.0 alpha9
parseplatform parse dashboard Versi 8.0.0 alpha1
parseplatform parse dashboard Versi 8.0.0 alpha2
parseplatform parse dashboard Versi 8.0.0 alpha3
parseplatform parse dashboard Versi 8.0.0 alpha4
parseplatform parse dashboard Versi 8.0.0 alpha5
parseplatform parse dashboard Versi 8.0.0 alpha6
parseplatform parse dashboard Versi 8.1.0 alpha1
parseplatform parse dashboard Versi 8.1.0 alpha10
parseplatform parse dashboard Versi 8.1.0 alpha11
parseplatform parse dashboard Versi 8.1.0 alpha12
parseplatform parse dashboard Versi 8.1.0 alpha13
parseplatform parse dashboard Versi 8.1.0 alpha2
parseplatform parse dashboard Versi 8.1.0 alpha3
parseplatform parse dashboard Versi 8.1.0 alpha4
parseplatform parse dashboard Versi 8.1.0 alpha5
parseplatform parse dashboard Versi 8.1.0 alpha6
parseplatform parse dashboard Versi 8.1.0 alpha7
parseplatform parse dashboard Versi 8.1.0 alpha8
parseplatform parse dashboard Versi 8.1.0 alpha9
parseplatform parse dashboard Versi 8.1.1 alpha1
parseplatform parse dashboard Versi 8.2.0 alpha1
parseplatform parse dashboard Versi 8.2.0 alpha10
parseplatform parse dashboard Versi 8.2.0 alpha11
parseplatform parse dashboard Versi 8.2.0 alpha12
parseplatform parse dashboard Versi 8.2.0 alpha13
parseplatform parse dashboard Versi 8.2.0 alpha14
parseplatform parse dashboard Versi 8.2.0 alpha15
parseplatform parse dashboard Versi 8.2.0 alpha16
parseplatform parse dashboard Versi 8.2.0 alpha17
parseplatform parse dashboard Versi 8.2.0 alpha18
parseplatform parse dashboard Versi 8.2.0 alpha19
parseplatform parse dashboard Versi 8.2.0 alpha2

> Data dari konfigurasi CPE di NVD. Ditampilkan 60 dari 135 konfigurasi; daftar lengkap ada di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.