The vulnerability arises from a cache key collision in the ConfigKeyCache component of Parse Dashboard, causing master key material to be stored and subsequently retrieved under an incorrectly shared cache key. Under certain timing conditions, a read‑only user can retrieve the full master key, and a regular user can obtain the read‑only master key. The exposure enables an attacker to elevate privileges or gain unrestricted access to data, effectively turning a low‑privilege session into an administrative one.

Parse Dashboard, a standalone interface for Parse Server applications, is affected. Vendors: parse-community; product: parse-dashboard. All releases from 7.3.0‑alpha.42 through 9.0.0‑alpha.7 are vulnerable. These include numerous pre‑release alpha builds spanning versions 7.x to 9.x as enumerated in the CPE list.

The vulnerability carries a CVSS score of 7, indicating high severity, but the EPSS score is below 1 %, suggesting very low exploitation probability at present. It is not listed in the KEV catalog, so there is no known widespread exploitation. A potential attacker needs read‑only access to the dashboard and must trigger the concurrent cache usage that leads to the collision; the attack vector would be via authenticated but low‑privilege sessions, likely requiring specific timing or concurrent requests. The impact is significant if successfully exploited.