Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
4 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact The ConfigKeyCache uses the same cache key for both master key and read-only master key when resolving function-typed keys. Under specific timing conditions, a read-only user can receive the cached full master key, or a regular user can receive the cached read-only master key. Patches The fix uses distinct cache keys for master key and read-only master key. Workarounds Avoid using function-typed master keys, or remove the agent configuration block from your dashboard configuration. Resources - GitHub advisory: https://github.com/parse-community/parse-dashboard/security/advisories/GHSA-jhp4-jvq3-w5xr - Fixed in: https://github.com/parse-community/parse-dashboard/releases/tag/9.0.0-alpha.8
Recommended action: Upgrade to 9.0.0-alpha.8 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The AI Agent API endpoint (POST /apps/:appId/agent) lacks CSRF protection. An attacker can craft a malicious page that, when visited by an authenticated dashboard user, submits requests to the agent endpoint using the victim's session. Patches The fix adds CSRF middleware to the agent endpoint and embeds a CSRF token in the dashboard page. Workarounds Remove the agent configuration block from your dashboard configuration. Dashboards without an agent config are not affected. Resources - GitHub advisory: https://github.com/parse-community/parse-dashboard/security/advisories/GHSA-3534-xp88-25rc - Fixed in: https://github.com/parse-community/parse-dashboard/releases/tag/9.0.0-alpha.8
Recommended action: Upgrade to 9.0.0-alpha.8 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The AI Agent API endpoint (POST /apps/:appId/agent) does not enforce authorization. Authenticated users scoped to specific apps can access any other app's agent endpoint by changing the app ID in the URL. Read-only users are given the full master key instead of the read-only master key and can supply write permissions in the request body to perform write and delete operations. Affected are only dashboards with agent configuration enabled. Patches The fix adds per-app authorization checks and restricts read-only users to the readOnlyMasterKey with write permissions stripped server-side. Workarounds Remove the agent configuration block from your dashboard configuration. Dashboards without an agent config are not affected. Resources - GitHub advisory: https://github.com/parse-community/parse-dashboard/security/advisories/GHSA-cvwj-6c9h-jg6v - Fixed in: https://github.com/parse-community/parse-dashboard/releases/tag/9.0.0-alpha.8
Recommended action: Upgrade to 9.0.0-alpha.8 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The AI Agent API endpoint (POST /apps/:appId/agent) lacks authentication. Unauthenticated remote attackers can send requests to the endpoint and perform arbitrary database operations against any connected Parse Server using the master key. Patches The fix adds authentication middleware to the agent endpoint. Workarounds Remove the agent configuration block from your dashboard configuration. Dashboards without an agent config are not affected. Resources - GitHub advisory: https://github.com/parse-community/parse-dashboard/security/advisories/GHSA-qwc3-h9mg-4582 - Fixed in: https://github.com/parse-community/parse-dashboard/releases/tag/9.0.0-alpha.8
Recommended action: Upgrade to 9.0.0-alpha.8 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.