8.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-27609

CVE-2026-27609: Parse Dashboard Missing CSRF Protection on Agent Endpoint

Parse Dashboard is a standalone dashboard for managing Parse Server apps. In versions 7.3.0-alpha.42 through 9.0.0-alpha.7, the AI Agent API endpoint (POST /apps/:appId/agent) lacks CSRF protection. An attacker can craft a malicious page that, when visited by an authenticated dashboard user, submits requests to the agent endpoint using the victim's session. The fix in version 9.0.0-alpha.8 adds CSRF middleware to the agent endpoint and embeds a CSRF token in the dashboard page. As a workaround, remove the agent configuration block from your dashboard configuration. Dashboards without an agent config are not affected.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-27609

CVE-2026-27609:

8.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
parse-dashboard	npm	>= 7.3.0-alpha.42, < 9.0.0-alpha.8	9.0.0-alpha.8

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic Cross-Site Request Forgery (CSRF) issue on the AI Agent API endpoint, POST /apps/:appId/agent. The advisory and commit history clearly indicate that this endpoint was missing CSRF protection. The fixing commit f92a9ef5246d57e51696bd881a15f3b133b2bb50 addresses this by adding Authentication.csrfProtection middleware to the Express route definition for the agent endpoint in Parse-Dashboard/app.js. The logic that processes the agent requests was originally in an anonymous function, which the patch refactored into a named function agentHandler. This function is the one that would execute upon a successful CSRF attack, as it contains the business logic for the agent endpoint. Therefore, agentHandler is identified as the key function related to this vulnerability. The patch also adds the CSRF token to the main dashboard page, which is necessary for legitimate client-side requests to work after the CSRF protection is enabled.

Vulnerable functions

agentHandler

Parse-Dashboard/app.js

The `agentHandler` function, which was an anonymous function prior to the patch, is the route handler for the `POST /apps/:appId/agent` endpoint. This endpoint was vulnerable to Cross-Site Request Forgery (CSRF) because it did not validate CSRF tokens. An attacker could trick an authenticated user into visiting a malicious website, which would then send a forged request to the agent endpoint. This request would be processed by `agentHandler` using the victim's session, potentially leading to unauthorized actions.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.