CSRF Vulnerability in Parse Dashboard Affects Multiple Versions by Parse Community

CVE-2026-27609

What is CVE-2026-27609?

The Parse Dashboard, utilized for managing Parse Server applications, contains a Cross-Site Request Forgery (CSRF) vulnerability in its AI Agent API endpoint during versions 7.3.0-alpha.42 to 9.0.0-alpha.7. Due to the absence of CSRF protection, malicious actors can exploit this weakness by crafting deceptive web pages that, when accessed by an authenticated user, trigger unauthorized requests to the agent endpoint using the user's session. To mitigate this issue, the recent fix in version 9.0.0-alpha.8 introduces CSRF middleware and integrates a CSRF token into the dashboard interface. For users seeking immediate action, removing the agent configuration block from the dashboard settings serves as a temporary workaround.

References