Vulnerability in Parse Dashboard Affects User Key Management

CVE-2026-27610

What is CVE-2026-27610?

In specific versions of Parse Dashboard, the ConfigKeyCache improperly uses a shared cache key for both the master key and the read-only master key. This flaw can lead to scenarios where a read-only user may inadvertently access the full master key due to timing conditions. Alternatively, regular users may gain access to the read-only master key. It is recommended to upgrade to version 9.0.0-alpha.8, which resolves this issue by implementing distinct cache keys, or temporarily avoid function-typed master keys and adjust the dashboard configuration to mitigate risks.

References