CVE-2026-27608

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27608", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-20T19:43:14.602Z", "datePublished": "2026-02-25T02:16:30.622Z", "dateUpdated": "2026-02-25T18:58:39.218Z"}, "containers": {"cna": {"title": "Parse Dashboard Missing Authorization on Agent Endpoint", "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "lang": "en", "description": "CWE-862: Missing Authorization", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "baseScore": 9.3, "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/parse-community/parse-dashboard/security/advisories/GHSA-cvwj-6c9h-jg6v", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/parse-community/parse-dashboard/security/advisories/GHSA-cvwj-6c9h-jg6v"}, {"name": "https://github.com/parse-community/parse-dashboard/releases/tag/9.0.0-alpha.8", "tags": ["x_refsource_MISC"], "url": "https://github.com/parse-community/parse-dashboard/releases/tag/9.0.0-alpha.8"}], "affected": [{"vendor": "parse-community", "product": "parse-dashboard", "versions": [{"version": ">= 7.3.0-alpha.42, < 9.0.0-alpha.8", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-25T02:16:30.622Z"}, "descriptions": [{"lang": "en", "value": "Parse Dashboard is a standalone dashboard for managing Parse Server apps. In versions 7.3.0-alpha.42 through 9.0.0-alpha.7, the AI Agent API endpoint (`POST /apps/:appId/agent`) does not enforce authorization. Authenticated users scoped to specific apps can access any other app's agent endpoint by changing the app ID in the URL. Read-only users are given the full master key instead of the read-only master key and can supply write permissions in the request body to perform write and delete operations. Only dashboards with `agent` configuration enabled are affected. The fix in version 9.0.0-alpha.8 adds per-app authorization checks and restricts read-only users to the `readOnlyMasterKey` with write permissions stripped server-side. As a workaround, remove the `agent` configuration block from your dashboard configuration. Dashboards without an `agent` config are not affected."}], "source": {"advisory": "GHSA-cvwj-6c9h-jg6v", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-25T18:55:55.191858Z", "id": "CVE-2026-27608", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-25T18:58:39.218Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27608", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-25T18:55:55.191858Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-25T18:56:10.501Z"}}], "cna": {"title": "Parse Dashboard Missing Authorization on Agent Endpoint", "source": {"advisory": "GHSA-cvwj-6c9h-jg6v", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 9.3, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "parse-community", "product": "parse-dashboard", "versions": [{"status": "affected", "version": ">= 7.3.0-alpha.42, < 9.0.0-alpha.8"}]}], "references": [{"url": "https://github.com/parse-community/parse-dashboard/security/advisories/GHSA-cvwj-6c9h-jg6v", "name": "https://github.com/parse-community/parse-dashboard/security/advisories/GHSA-cvwj-6c9h-jg6v", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/parse-community/parse-dashboard/releases/tag/9.0.0-alpha.8", "name": "https://github.com/parse-community/parse-dashboard/releases/tag/9.0.0-alpha.8", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Parse Dashboard is a standalone dashboard for managing Parse Server apps. In versions 7.3.0-alpha.42 through 9.0.0-alpha.7, the AI Agent API endpoint (`POST /apps/:appId/agent`) does not enforce authorization. Authenticated users scoped to specific apps can access any other app's agent endpoint by changing the app ID in the URL. Read-only users are given the full master key instead of the read-only master key and can supply write permissions in the request body to perform write and delete operations. Only dashboards with `agent` configuration enabled are affected. The fix in version 9.0.0-alpha.8 adds per-app authorization checks and restricts read-only users to the `readOnlyMasterKey` with write permissions stripped server-side. As a workaround, remove the `agent` configuration block from your dashboard configuration. Dashboards without an `agent` config are not affected."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862: Missing Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-25T02:16:30.622Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27608", "state": "PUBLISHED", "dateUpdated": "2026-02-25T18:58:39.218Z", "dateReserved": "2026-02-20T19:43:14.602Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-25T02:16:30.622Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "parse-dashboard", "vendor": "parse-community", "versions": [{"status": "affected", "version": ">= 7.3.0-alpha.42, < 9.0.0-alpha.8"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.3.0:alpha42:*:*:*:node.js:*:*", "matchCriteriaId": "07E54A25-BB5E-4E4F-B3EC-0B9979CC067D", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.3.0:alpha43:*:*:*:node.js:*:*", "matchCriteriaId": "C8E605D1-F9FB-4AB4-9FFA-211F01496FEB", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.3.0:alpha44:*:*:*:node.js:*:*", "matchCriteriaId": "0E68DA89-5409-4F06-A69A-7C4672D10521", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.3.0:alpha5:*:*:*:node.js:*:*", "matchCriteriaId": "F41426EE-2CD5-4E74-A4D0-1B3BA49A9481", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.3.0:alpha6:*:*:*:node.js:*:*", "matchCriteriaId": "97BF4F76-319D-4DE8-A6E4-A8F08D384C59", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.3.0:alpha7:*:*:*:node.js:*:*", "matchCriteriaId": "83A19B88-2B7B-4C19-ABC9-AB01574608D2", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.3.0:alpha8:*:*:*:node.js:*:*", "matchCriteriaId": "B96B7FF8-7BF6-48B8-9887-EA7D9327DF35", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.3.0:alpha9:*:*:*:node.js:*:*", "matchCriteriaId": "014B82A6-F7D9-4B05-8D36-31781D177D9D", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.4.0:alpha1:*:*:*:node.js:*:*", "matchCriteriaId": "E6B6F40D-5FD8-4EF9-9AE9-DCA471C5CAFC", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.4.0:alpha2:*:*:*:node.js:*:*", "matchCriteriaId": "04966183-2013-4AC5-95C0-C3536AE97D3F", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.4.0:alpha3:*:*:*:node.js:*:*", "matchCriteriaId": "00572EFD-7E41-42D9-8412-0C25F9AAABE8", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.4.0:alpha4:*:*:*:node.js:*:*", "matchCriteriaId": "E444707A-C905-485C-8CDB-AE3B8780C56A", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.4.0:alpha5:*:*:*:node.js:*:*", "matchCriteriaId": "49327FD3-E9B0-4245-8126-EF44DDE6EB17", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.5.0:alpha1:*:*:*:node.js:*:*", "matchCriteriaId": "F068BEBE-FF4F-45BA-A3ED-C1A4E6ACA2FF", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.5.0:alpha2:*:*:*:node.js:*:*", "matchCriteriaId": "819B012F-E02A-4E7E-8935-F534270F8A80", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.6.0:alpha1:*:*:*:node.js:*:*", "matchCriteriaId": "25C0D991-B416-4BC1-882A-61FFB3E815CB", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.6.0:alpha10:*:*:*:node.js:*:*", "matchCriteriaId": "44D86A4C-7105-42BE-82B3-15736D0C7164", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.6.0:alpha11:*:*:*:node.js:*:*", "matchCriteriaId": "8EFB3F3E-4F2F-4975-8B5D-CC6E17489386", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.6.0:alpha12:*:*:*:node.js:*:*", "matchCriteriaId": "BADD19AE-F281-4222-B7BE-535EC4045F4B", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.6.0:alpha13:*:*:*:node.js:*:*", "matchCriteriaId": "EB952B96-D2A1-4706-8054-C3DB72388E49", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.6.0:alpha2:*:*:*:node.js:*:*", "matchCriteriaId": "B867C0D1-DB8B-44E9-B147-F92A74BF0B98", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.6.0:alpha3:*:*:*:node.js:*:*", "matchCriteriaId": "5AE07136-83B7-4DE5-9F90-3C3B11E0AF78", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.6.0:alpha4:*:*:*:node.js:*:*", "matchCriteriaId": "5EA360CA-BFAB-4CDE-AD59-CC10F5D0601B", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.6.0:alpha5:*:*:*:node.js:*:*", "matchCriteriaId": "0471F4A9-2DF0-429E-86BA-267F8DA92319", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.6.0:alpha6:*:*:*:node.js:*:*", "matchCriteriaId": "74421939-B72D-41DA-A276-2137C8D87A3C", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.6.0:alpha7:*:*:*:node.js:*:*", "matchCriteriaId": "620A6F14-7697-4B03-A116-6E54DD6DD806", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.6.0:alpha8:*:*:*:node.js:*:*", "matchCriteriaId": "6959259A-2208-42B9-8FD4-65BB60F8A355", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:7.6.0:alpha9:*:*:*:node.js:*:*", "matchCriteriaId": "F1E70933-B30D-493C-A8BA-20FA873E3AFD", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.0.0:alpha1:*:*:*:node.js:*:*", "matchCriteriaId": "59953623-4467-4BF8-916D-7FAF85E7B112", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.0.0:alpha2:*:*:*:node.js:*:*", "matchCriteriaId": "006F6095-1A9A-4418-B7A3-9040823B6D0E", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.0.0:alpha3:*:*:*:node.js:*:*", "matchCriteriaId": "A7902611-FAC7-43A6-A86A-0B6D232EE3F8", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.0.0:alpha4:*:*:*:node.js:*:*", "matchCriteriaId": "ACC8F371-7DA0-4269-9080-3CCEF0F193FF", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.0.0:alpha5:*:*:*:node.js:*:*", "matchCriteriaId": "E7835681-3581-4834-B6F1-0F48CD5231F4", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.0.0:alpha6:*:*:*:node.js:*:*", "matchCriteriaId": "4760B32F-6943-4BC6-9893-ECE12839291D", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.1.0:alpha1:*:*:*:node.js:*:*", "matchCriteriaId": "F1598567-50D0-4D26-9B60-6067E8070D9B", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.1.0:alpha10:*:*:*:node.js:*:*", "matchCriteriaId": "02CDB7B1-5CD7-402D-ACDA-CFD5DCCA1455", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.1.0:alpha11:*:*:*:node.js:*:*", "matchCriteriaId": "4E461A18-5EB0-4E9E-9670-82B2ABF568F4", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.1.0:alpha12:*:*:*:node.js:*:*", "matchCriteriaId": "794EE02E-6D86-4E4D-9F00-443BFFB78C54", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.1.0:alpha13:*:*:*:node.js:*:*", "matchCriteriaId": "6120C309-768A-4477-BF34-0AD21A104A19", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.1.0:alpha2:*:*:*:node.js:*:*", "matchCriteriaId": "4314A7D2-5CA8-4081-BF2B-88A7175B14FE", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.1.0:alpha3:*:*:*:node.js:*:*", "matchCriteriaId": "A222119F-5962-49E2-94B5-C3BBC8B19584", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.1.0:alpha4:*:*:*:node.js:*:*", "matchCriteriaId": "7F8A9B5B-A1CE-4C86-A031-E638FDEAFE8A", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.1.0:alpha5:*:*:*:node.js:*:*", "matchCriteriaId": "D5365B15-3725-4E8B-A0BA-2D4513706AEC", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.1.0:alpha6:*:*:*:node.js:*:*", "matchCriteriaId": "CEE8CA47-2A8A-44F4-8ABC-C899DA12A49C", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.1.0:alpha7:*:*:*:node.js:*:*", "matchCriteriaId": "B4065C00-6E46-4B19-B32F-9A485EF9AAB4", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.1.0:alpha8:*:*:*:node.js:*:*", "matchCriteriaId": "E6A9E323-7A79-4068-A596-826DB8393273", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.1.0:alpha9:*:*:*:node.js:*:*", "matchCriteriaId": "F07743D3-82D8-425E-918E-D689DFF5B456", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.1.1:alpha1:*:*:*:node.js:*:*", "matchCriteriaId": "77DE8253-E642-4247-8AD7-444C658C11B7", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha1:*:*:*:node.js:*:*", "matchCriteriaId": "45558A90-0C09-485F-BC7A-DC7403AADA9F", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha10:*:*:*:node.js:*:*", "matchCriteriaId": "147EA8FF-8CCD-442C-A9AF-B3B413AC08AD", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha11:*:*:*:node.js:*:*", "matchCriteriaId": "DE95BEF0-E579-4EAF-BC5D-49C6A097A029", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha12:*:*:*:node.js:*:*", "matchCriteriaId": "B9C9BAF7-52AA-4117-9EB9-15B23625BB4A", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha13:*:*:*:node.js:*:*", "matchCriteriaId": "751EF4D4-017A-40E6-A4DA-73CE3E6E6F18", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha14:*:*:*:node.js:*:*", "matchCriteriaId": "909CEA7C-20A0-4E59-80CA-ECED455AB0A4", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha15:*:*:*:node.js:*:*", "matchCriteriaId": "9CDE7AA9-E25F-4614-8824-75BD61137383", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha16:*:*:*:node.js:*:*", "matchCriteriaId": "62F4B0D7-F3C2-4279-97D7-027FA84A69D0", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha17:*:*:*:node.js:*:*", "matchCriteriaId": "AB00F9FE-2BC9-4DDC-90EC-BB4E344D7FAE", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha18:*:*:*:node.js:*:*", "matchCriteriaId": "F747C7B3-7B22-4977-ACA6-A61A72966EBA", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha19:*:*:*:node.js:*:*", "matchCriteriaId": "CFA065EB-17EF-4BDC-90C3-7612DA0BAEE3", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha2:*:*:*:node.js:*:*", "matchCriteriaId": "3D063244-3964-4538-BD71-444C4AC78159", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha20:*:*:*:node.js:*:*", "matchCriteriaId": "14F2E6D0-BF45-44C6-B09E-BBCB0D9A5B9D", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha21:*:*:*:node.js:*:*", "matchCriteriaId": "A035B1BF-8A6E-43BD-B497-5880069DE701", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha22:*:*:*:node.js:*:*", "matchCriteriaId": "EA0EF875-506C-41F6-9982-C615BD7F736A", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha23:*:*:*:node.js:*:*", "matchCriteriaId": "C685FFA6-8C20-4E45-8C8F-7CAE843272E7", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha24:*:*:*:node.js:*:*", "matchCriteriaId": "E5069E97-CAAC-4609-A679-D9ED85E46183", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha25:*:*:*:node.js:*:*", "matchCriteriaId": "0A3896DE-2FEE-4745-93D4-20B94CF821B0", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha26:*:*:*:node.js:*:*", "matchCriteriaId": "12BB3FFA-33B6-46DA-B128-41F1B569EEDA", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha27:*:*:*:node.js:*:*", "matchCriteriaId": "1BEA50F8-8F8C-4CF2-A0D2-83FE4A417984", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha3:*:*:*:node.js:*:*", "matchCriteriaId": "68AAA2B1-BCFA-47B5-B340-CD7B182EE0DD", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha4:*:*:*:node.js:*:*", "matchCriteriaId": "FB746E76-8E6D-4AA1-9E41-8B621F6B0817", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha5:*:*:*:node.js:*:*", "matchCriteriaId": "8606D8A6-3670-4C7A-89C0-C79B47DAE462", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha6:*:*:*:node.js:*:*", "matchCriteriaId": "AC53D1E9-E4DE-47BD-961A-AE3B201E6D9B", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha7:*:*:*:node.js:*:*", "matchCriteriaId": "11921795-B289-49B8-9B13-9E4D092DAD1D", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha8:*:*:*:node.js:*:*", "matchCriteriaId": "C9CC23DE-F84D-48F3-9474-65B240B4A773", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.2.0:alpha9:*:*:*:node.js:*:*", "matchCriteriaId": "4D0E3EE7-57AD-469E-8C16-58A797413D09", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha1:*:*:*:node.js:*:*", "matchCriteriaId": "6E8CFB57-3235-48EF-85AA-6F93F75DBFFE", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha10:*:*:*:node.js:*:*", "matchCriteriaId": "298D7F20-184C-4D46-9BD0-952A5238CE38", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha11:*:*:*:node.js:*:*", "matchCriteriaId": "4EDA824F-BDD0-45CF-8707-90152F0DC8A5", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha12:*:*:*:node.js:*:*", "matchCriteriaId": "EFC686E3-4ACA-4DCE-8619-872A1D5A00E6", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha13:*:*:*:node.js:*:*", "matchCriteriaId": "62C667AB-C243-4EE5-A11F-903548659361", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha14:*:*:*:node.js:*:*", "matchCriteriaId": "BE5FFADF-61A9-4020-A440-A87513F8D16E", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha15:*:*:*:node.js:*:*", "matchCriteriaId": "812CD7D7-E4D0-4121-BB4B-861AFE503215", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha16:*:*:*:node.js:*:*", "matchCriteriaId": "A9686411-3378-4786-9581-CAF7214C3482", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha17:*:*:*:node.js:*:*", "matchCriteriaId": "D5BAA8AC-6CC6-4B5E-A487-BC3665388CCF", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha18:*:*:*:node.js:*:*", "matchCriteriaId": "C96A930D-5799-4414-8146-466A207E7E30", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha19:*:*:*:node.js:*:*", "matchCriteriaId": "CB077789-E12B-46A3-B81F-4EA99A1DE9E9", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha2:*:*:*:node.js:*:*", "matchCriteriaId": "11C1FCFE-6D33-45F4-837D-26E9F01054C5", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha20:*:*:*:node.js:*:*", "matchCriteriaId": "200E06EA-A9AB-48E5-96D7-E4A8E33D29A4", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha21:*:*:*:node.js:*:*", "matchCriteriaId": "99D5280F-7737-4D4A-9342-2DB2BA95E229", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha22:*:*:*:node.js:*:*", "matchCriteriaId": "274221FB-AF14-47A7-87AE-93387A65C7B6", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha23:*:*:*:node.js:*:*", "matchCriteriaId": "018EF99F-F091-4D7B-9EB9-AF8E24D51846", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha24:*:*:*:node.js:*:*", "matchCriteriaId": "CADB1CC2-8821-4BC8-BDE0-F543A9CC1B26", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha25:*:*:*:node.js:*:*", "matchCriteriaId": "1891DDB0-64E4-4D4F-A8BB-4839DE3334E3", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha26:*:*:*:node.js:*:*", "matchCriteriaId": "61914E73-4231-4BBF-8BA3-542FE40DADD8", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha27:*:*:*:node.js:*:*", "matchCriteriaId": "EAE46D0A-5E3B-4DD7-B6BF-5F93E9193B21", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha28:*:*:*:node.js:*:*", "matchCriteriaId": "4CF57878-E430-4600-9B99-CC39BE38CDE1", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha29:*:*:*:node.js:*:*", "matchCriteriaId": "A12F9A7B-C5D0-444F-8422-58D1041AAE10", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha3:*:*:*:node.js:*:*", "matchCriteriaId": "C219A394-FB58-49C4-9EC1-50F5780B1F71", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha30:*:*:*:node.js:*:*", "matchCriteriaId": "A4BFB7F4-A2F6-43F8-9883-883F7B556419", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha31:*:*:*:node.js:*:*", "matchCriteriaId": "003CAEE4-938C-4B9B-9BD2-1894C2B3F2CA", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha32:*:*:*:node.js:*:*", "matchCriteriaId": "B7EE5788-DAC1-447A-872D-829B17C02FAA", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha33:*:*:*:node.js:*:*", "matchCriteriaId": "5B4DDFC3-21D9-447D-9777-5CF2D54C2303", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha34:*:*:*:node.js:*:*", "matchCriteriaId": "DB68E100-845B-4AD1-A9F6-F31BD98C5816", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha35:*:*:*:node.js:*:*", "matchCriteriaId": "F653F5C7-7F6F-476B-B435-4DB002B8FCE0", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha36:*:*:*:node.js:*:*", "matchCriteriaId": "1FE9FBDF-C5D0-429E-9D7B-515764392173", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha37:*:*:*:node.js:*:*", "matchCriteriaId": "9CC31EDA-E346-4512-B61D-459D1B7DF03F", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha38:*:*:*:node.js:*:*", "matchCriteriaId": "BD2D4595-10FD-4895-B022-975DFD5CE9EB", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha39:*:*:*:node.js:*:*", "matchCriteriaId": "8904600C-658B-4514-B466-723FEC00DC6C", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha4:*:*:*:node.js:*:*", "matchCriteriaId": "4CDC52FD-7C85-4208-A3A1-9F233206D002", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha40:*:*:*:node.js:*:*", "matchCriteriaId": "F833E1DE-406E-4933-BF58-51F130F351E7", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha41:*:*:*:node.js:*:*", "matchCriteriaId": "8637DC90-96F3-4BB3-8E99-1736E21F91BD", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha42:*:*:*:node.js:*:*", "matchCriteriaId": "5CA06430-8360-4DBE-B0DB-0D6FCD43B753", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha43:*:*:*:node.js:*:*", "matchCriteriaId": "13498595-56D9-47B9-A0CE-9D7C8C1BD8AD", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha5:*:*:*:node.js:*:*", "matchCriteriaId": "459F8862-2EFD-46AA-8D2D-D7750DFC843E", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha6:*:*:*:node.js:*:*", "matchCriteriaId": "85D6E3FE-A2D4-476B-AF63-75213CD55A9C", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha7:*:*:*:node.js:*:*", "matchCriteriaId": "33E7DDE6-F753-42B1-8F1C-4E9A7422AE09", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha8:*:*:*:node.js:*:*", "matchCriteriaId": "A40DD8A4-E9ED-437E-8BAC-A5119E982A7C", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.3.0:alpha9:*:*:*:node.js:*:*", "matchCriteriaId": "DA4D845B-7B44-4F4A-93A5-A157D2E69408", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.4.0:alpha1:*:*:*:node.js:*:*", "matchCriteriaId": "C227B90E-83CD-4BF9-BB65-61C5FA3A8817", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.4.1:alpha1:*:*:*:node.js:*:*", "matchCriteriaId": "9AFC7739-810A-4D2A-9F00-30FA0E31D4FA", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.4.1:alpha2:*:*:*:node.js:*:*", "matchCriteriaId": "8CC23CD5-169B-4D16-A092-573299623DE3", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.5.0:alpha1:*:*:*:node.js:*:*", "matchCriteriaId": "9D47A3D8-F005-49CC-B83E-CA4BCC619663", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.5.0:alpha2:*:*:*:node.js:*:*", "matchCriteriaId": "54C60FCF-96EB-49D5-9A40-215D769403E6", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.5.0:alpha3:*:*:*:node.js:*:*", "matchCriteriaId": "BD4887CA-69F6-46F4-88E3-9ADF7965E48B", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.5.0:alpha4:*:*:*:node.js:*:*", "matchCriteriaId": "B3862636-438C-41B4-8643-3E7F30ADC425", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.5.0:alpha5:*:*:*:node.js:*:*", "matchCriteriaId": "6AB9AB22-C0EA-4988-9FB3-0F47B535FF99", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.5.0:alpha6:*:*:*:node.js:*:*", "matchCriteriaId": "CA6BE3E4-2C95-4C9A-84CF-2A979DF7DAA0", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:8.5.0:alpha7:*:*:*:node.js:*:*", "matchCriteriaId": "A650E481-B5B7-48C7-9E84-94B79A71701A", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:9.0.0:alpha1:*:*:*:node.js:*:*", "matchCriteriaId": "A264AC19-AE25-448D-9F18-20AE8163170B", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:9.0.0:alpha2:*:*:*:node.js:*:*", "matchCriteriaId": "C5EDF6CE-A994-4598-BB40-A1FBCB0C8D50", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:9.0.0:alpha3:*:*:*:node.js:*:*", "matchCriteriaId": "3AD71B52-42CB-4D07-A63B-028824213837", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:9.0.0:alpha4:*:*:*:node.js:*:*", "matchCriteriaId": "8AF361C5-6825-4921-B24C-E1D627D417EA", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:9.0.0:alpha5:*:*:*:node.js:*:*", "matchCriteriaId": "0A3BD430-B209-46AC-9944-2D59B0192CCA", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:9.0.0:alpha6:*:*:*:node.js:*:*", "matchCriteriaId": "713C7B39-2A07-4386-B46F-FF358EB36F57", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse_dashboard:9.0.0:alpha7:*:*:*:node.js:*:*", "matchCriteriaId": "59EF4AB1-6A2D-473A-A2DF-538CCC92F6A3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Parse Dashboard is a standalone dashboard for managing Parse Server apps. In versions 7.3.0-alpha.42 through 9.0.0-alpha.7, the AI Agent API endpoint (`POST /apps/:appId/agent`) does not enforce authorization. Authenticated users scoped to specific apps can access any other app's agent endpoint by changing the app ID in the URL. Read-only users are given the full master key instead of the read-only master key and can supply write permissions in the request body to perform write and delete operations. Only dashboards with `agent` configuration enabled are affected. The fix in version 9.0.0-alpha.8 adds per-app authorization checks and restricts read-only users to the `readOnlyMasterKey` with write permissions stripped server-side. As a workaround, remove the `agent` configuration block from your dashboard configuration. Dashboards without an `agent` config are not affected."}, {"lang": "es", "value": "Parse Dashboard es un panel de control independiente para gestionar aplicaciones de Parse Server. En las versiones 7.3.0-alpha.42 hasta la 9.0.0-alpha.7, el endpoint de la API del Agente de IA (`POST /apps/:appId/agent`) no aplica la autorizaci\u00f3n. Los usuarios autenticados con \u00e1mbito a aplicaciones espec\u00edficas pueden acceder al endpoint del agente de cualquier otra aplicaci\u00f3n cambiando el ID de la aplicaci\u00f3n en la URL. A los usuarios de solo lectura se les otorga la clave maestra completa en lugar de la clave maestra de solo lectura y pueden proporcionar permisos de escritura en el cuerpo de la solicitud para realizar operaciones de escritura y eliminaci\u00f3n. Solo los paneles de control con la configuraci\u00f3n de `agent` habilitada se ven afectados. La correcci\u00f3n en la versi\u00f3n 9.0.0-alpha.8 a\u00f1ade comprobaciones de autorizaci\u00f3n por aplicaci\u00f3n y restringe a los usuarios de solo lectura a la `readOnlyMasterKey` con los permisos de escritura eliminados en el lado del servidor. Como soluci\u00f3n alternativa, elimine el bloque de configuraci\u00f3n de `agent` de la configuraci\u00f3n de su panel de control. Los paneles de control sin una configuraci\u00f3n de `agent` no se ven afectados."}], "id": "CVE-2026-27608", "lastModified": "2026-06-26T17:00:00.557", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27608", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-25T18:55:55.191858Z", "version": "2.0.3"}}]}, "published": "2026-02-25T03:16:04.960", "references": [{"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/parse-community/parse-dashboard/releases/tag/9.0.0-alpha.8"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/parse-community/parse-dashboard/security/advisories/GHSA-cvwj-6c9h-jg6v"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.3.0-alpha.42,9.0.0-alpha.8)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "parse-dashboard", "source": "cna", "vendor": "parse-community"}, "product": "parse_dashboard", "vendor": "parse_community"}], "analysis": {"en": {"generated_at": "2026-04-17T15:31:25.376896+00:00", "value": {"mitigation_remediation": ["Upgrade to Parse Dashboard version 9.0.0\u2011alpha.8 or newer, which introduces per\u2011app authorization checks and limits write permissions for read\u2011only users.", "For dashboards that cannot be upgraded immediately, remove the entire agent configuration block from the dashboard configuration file; dashboards without an agent config are not affected by this vulnerability.", "After applying the upgrade or configuration change, verify that read\u2011only users are now restricted to the readOnlyMasterKey and that write permissions are stripped server\u2011side."], "summary": {"action": "Immediate patch", "impact": "Authorization bypass leading to unauthorized full master key access"}, "threat_synthesis": {"affected_systems": "Affected products are Parse Dashboard versions 7.3.0\u2011alpha.42 through 9.0.0\u2011alpha.7. Only instances with an agent configuration enabled are vulnerable. The product is distributed by parse-community under the name parse-dashboard. Any deployment of these versions without upgrading or removing the agent configuration is impacted.", "description_and_impact": "The vulnerability exists in the Parse Dashboard AI Agent API endpoint where no authorization check is performed for POST /apps/:appId/agent. Authenticated users can manipulate the URL to access another app\u2019s agent endpoint, and read\u2011only users are given the full master key instead of a reduced key. This allows them to send requests with write permissions, enabling data modification and deletion across apps. The weakness is a classic Authorization Bypass, mapped to CWE\u2011862.", "risk_and_exploitability": "The CVSS vector scores the flaw as 9.3, indicating high severity. The EPSS is below 1%, reflecting a very low but non\u2011zero probability of exploitation in the wild, and it is not currently listed in CISA\u2019s KEV catalog. The flaw is exploitable via the public network because the vulnerable endpoint is reachable over HTTPS. An attacker who can authenticate to a single app can gain access to other apps\u2019 data and master keys, compromising confidentiality, integrity, and availability of all applications served by the dashboard."}}}}, "created": "2026-02-25T11:35:04.746965+00:00", "updated": "2026-04-17T15:45:15.883832+00:00", "vendors": ["parse_community", "parse_community$PRODUCT$parse_dashboard"]}