Executive Summary

[{'type': 'paragraph', 'content': 'CVE-2026-27609 is a high-severity vulnerability in the parse-dashboard npm package affecting versions 7.3.0-alpha.42 through 9.0.0-alpha.7. The issue is that the AI Agent API endpoint (POST /apps/:appId/agent) lacks Cross-Site Request Forgery (CSRF) protection.'}, {'type': 'paragraph', 'content': "This means an attacker can create a malicious webpage that, when visited by an authenticated dashboard user, can submit unauthorized requests to the agent endpoint using the victim's session without their consent."}, {'type': 'paragraph', 'content': 'The vulnerability was fixed in version 9.0.0-alpha.8 by adding CSRF middleware to the agent endpoint and embedding a CSRF token in the dashboard page to prevent such unauthorized requests.'}, {'type': 'paragraph', 'content': "As a workaround, users can remove the 'agent' configuration block from their dashboard configuration, which disables the vulnerable endpoint."}] [1]

Useful 0 Not Useful 0

Impact Analysis

[{'type': 'paragraph', 'content': "This vulnerability can allow an attacker to perform unauthorized actions on the Parse Dashboard by submitting requests to the AI Agent API endpoint using the victim's authenticated session."}, {'type': 'paragraph', 'content': 'The impact is primarily on integrity, meaning the attacker can modify data or perform actions that the victim did not intend.'}, {'type': 'paragraph', 'content': 'There is no impact on confidentiality or availability, but the unauthorized modifications can have serious consequences depending on the application.'}] [1]

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

This vulnerability affects the AI Agent API endpoint (POST /apps/:appId/agent) in Parse Dashboard versions 7.3.0-alpha.42 through 9.0.0-alpha.7, which lacks CSRF protection.

To detect if your system is vulnerable, you can check the version of your parse-dashboard installation to see if it falls within the affected range.

Additionally, you can monitor network traffic or logs for POST requests to the /apps/:appId/agent endpoint originating from user sessions, which might indicate exploitation attempts.

There are no specific commands provided in the resources to detect this vulnerability directly.

Useful 0 Not Useful 0

Mitigation Strategies

[{'type': 'paragraph', 'content': 'The vulnerability was fixed in parse-dashboard version 9.0.0-alpha.8 by adding CSRF middleware to the agent endpoint and embedding a CSRF token in the dashboard page.'}, {'type': 'paragraph', 'content': 'Immediate mitigation steps include upgrading your parse-dashboard installation to version 9.0.0-alpha.8 or later.'}, {'type': 'paragraph', 'content': "As a workaround, if upgrading is not immediately possible, remove the 'agent' configuration block from your dashboard configuration. Dashboards without this configuration are not affected by the vulnerability."}] [1]

Useful 0 Not Useful 0