parse-community/parse-dashboard · Security
Parse Dashboard is Missing CSRF Protection for its Agent Endpoint
- GHSA ID
- GHSA-3534-xp88-25rc
- CVE ID
- CVE-2026-27609
- Severity
- high
- Published
- Updated
- CVSS v4
- 8.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N
Description
Impact
The AI Agent API endpoint (POST /apps/:appId/agent) lacks CSRF protection. An attacker can craft a malicious page that, when visited by an authenticated dashboard user, submits requests to the agent endpoint using the victim's session.
Patches
The fix adds CSRF middleware to the agent endpoint and embeds a CSRF token in the dashboard page.
Workarounds
Remove the agent configuration block from your dashboard configuration. Dashboards without an agent config are not affected.
Resources
CWEs
- CWE-352 · Cross-Site Request Forgery (CSRF)