Parse Dashboard CVE-2026-27610

Requires all of: an authenticated Parse Dashboard user session (read-only user to capture the master key, or a regular user to capture the read-only key - PR:L); the deployment must configure master keys as function-typed (callable) keys; and the agent configuration block / agent API must be enabled, since that path resolves keys through the shared ConfigKeyCache. Exploitation further depends on a timing race between concurrent requests of differing privilege levels (CVSS AC:H and AT:P), making it probabilistic rather than deterministic. Limiting factors: deployments using static string keys, or not using the agent feature, are not affected, and only alpha pre-release versions 7.3.0-alpha.42 through 9.0.0-alpha.7 are in scope.

Signals are consistent and point to a real but constrained issue. The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:L/UI:N, score 7.0) shows network reach but high complexity plus an attack requirement (AT:P) and low privileges - i.e. an authenticated user must win a timing race in a specific configuration. EPSS is very low (0.05%, 16th percentile) and the CVE is not in CISA KEV, with no public exploit identified at time of analysis, all of which argue against opportunistic mass exploitation. The most consequential conflict is in the impact scoring: the vendor rated confidentiality VC:N while marking integrity VI:H, yet leaking a full master key plainly exposes all backend data (a confidentiality impact) in addition to enabling writes - the assessor rates confidentiality higher than the published vector. Net: prioritize for environments that actually use function-typed master keys with the agent feature; for everyone else this is low practical risk, and the affected range being alpha pre-releases further limits exposure.

An attacker holding a legitimate read-only Parse Dashboard account, in a deployment using function-typed master keys with the agent feature, issues requests timed against a regular user's activity so that the ConfigKeyCache serves it the cached full master key. With the leaked master key the attacker bypasses read-only restrictions and gains full read/write control of the Parse backend. No public proof-of-concept is identified at time of analysis, and the timing dependence (CVSS AC:H/AT:P) makes reliable exploitation non-trivial.