PT-2026-21833 · Parse · Parse-Dashboard

Byamb4 · Publicado 2026-02-25 · Atualizado 2026-03-02 · CVE-2026-27595

Positive Technologies (AI Summary)

CVSS v4.0

9.9

Crítica

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Name of the Vulnerable Software and Affected Versions Parse Dashboard versions 7.3.0-alpha.42 through 9.0.0-alpha.7

Description Parse Dashboard, a standalone dashboard for managing Parse Server apps, contains security issues in the AI Agent API endpoint (/apps/:appId/agent). Versions 7.3.0-alpha.42 through 9.0.0-alpha.7 are affected by multiple vulnerabilities that, when combined, could allow attackers without authentication to perform arbitrary read and write operations on any connected Parse Server database using the master key. The agent feature must be enabled for the dashboard to be affected. The issue stems from a lack of authentication, Cross-Site Request Forgery (CSRF) validation, and per-app authorization on the agent endpoint. A cache key collision between the master key and read-only master key also contributed to the problem.

Recommendations Versions 7.3.0-alpha.42 through 9.0.0-alpha.7: Remove or comment out the agent configuration block from your Parse Dashboard configuration.

Exploit

Correção

Missing Authentication

Enumeração de Fraquezas

CWE-306

Identificadores relacionados

CVE-2026-27595

GHSA-QWC3-H9MG-4582

Produtos afetados

Parse-Dashboard

Referências · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27595.json · Exploit
• https://github.com/parse-community/parse-dashboard/releases/tag/9.0.0-alpha.8 · Nota
• https://github.com/parse-community/parse-dashboard · Nota
• https://github.com/parse-community/parse-dashboard/security/advisories/GHSA-qwc3-h9mg-4582 · Aviso do Fabricante
• https://github.com/parse-community/parse-dashboard/commit/f92a9ef5246d57e51696bd881a15f3b133b2bb50 · Nota
• https://osv.dev/vulnerability/CVE-2026-27595 · Aviso do Fabricante
• https://t.me/cveNotify/153568 · Publicação no Telegram
• https://twitter.com/pulsepatchio/status/2027396369040752703 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-27595 · Nota de Segurança
• https://twitter.com/cracbot/status/2028425184517267905 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2026641372967485705 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-qwc3-h9mg-4582 · Aviso do Fabricante
• https://t.me/cveNotify/153086 · Publicação no Telegram