7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-27610

CVE-2026-27610: Parse Dashboard Has a Cache Key Collision that Leaks Master Key to Read-Only Sessions

Parse Dashboard is a standalone dashboard for managing Parse Server apps. In versions 7.3.0-alpha.42 through 9.0.0-alpha.7, the ConfigKeyCache uses the same cache key for both master key and read-only master key when resolving function-typed keys. Under specific timing conditions, a read-only user can receive the cached full master key, or a regular user can receive the cached read-only master key. The fix in version 9.0.0-alpha.8 uses distinct cache keys for master key and read-only master key. As a workaround, avoid using function-typed master keys, or remove the agent configuration block from your dashboard configuration.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-27610

CVE-2026-27610:

7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
parse-dashboard	npm	>= 7.3.0-alpha.42, < 9.0.0-alpha.8	9.0.0-alpha.8

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, as described, is a cache key collision in ConfigKeyCache when resolving function-typed master keys. The provided commit f92a9ef5246d57e51696bd881a15f3b133b2bb50 directly addresses this issue in Parse-Dashboard/app.js.

The analysis of the patch shows two key modifications:

In an anonymous async function responsible for preparing the list of applications a user has access to, the call to ConfigKeyCache.get was updated. The original code (app.masterKey = await ConfigKeyCache.get(app.appId, 'masterKey', ...);) used a hardcoded cache key, which is the root cause of the vulnerability. The patch makes the cache key dependent on whether the access is read-only (const cacheKey = matchingAccess.readOnly ? 'readOnlyMasterKey' : 'masterKey';). This anonymous function is considered a vulnerable function.
The commit also refactors the /apps/:appId/agent endpoint into a new agentHandler function. Inside this new function, logic for resolving function-typed master keys is introduced, and it correctly uses distinct cache keys. This indicates that while the agent endpoint might not have been vulnerable to this specific issue before, the developer proactively applied the correct pattern during a refactoring effort that addressed other security concerns on that endpoint.

Both identified locations in the code were susceptible to or fixed for the same underlying logical flaw. A runtime profile during exploitation would show calls to ConfigKeyCache.get originating from these parts of the app.js module.

Vulnerable functions

(anonymous)

Parse-Dashboard/app.js

The vulnerability is in an anonymous async function within the main exported function of `app.js`. This function resolves function-typed master keys. It incorrectly uses a static cache key ('masterKey') for all key resolutions, failing to distinguish between regular and read-only master keys. This can cause a race condition where a read-only user could be served the full master key from the cache, leading to privilege escalation.

agentHandler

Parse-Dashboard/app.js

The `agentHandler` function, which handles requests to the AI agent endpoint, was modified to correctly handle function-typed master keys by using distinct cache keys for regular and read-only sessions. While the function itself contains the patched code, the vulnerability pattern (using a single cache key) was the issue being fixed. The introduction of this logic in `agentHandler` was part of a larger fix that also addressed the same issue in another part of the application.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.