PT-2026-21833 · Parse · Parse-Dashboard

Byamb4 · Published 2026-02-25 · Updated 2026-03-02 · CVE-2026-27595

Positive Technologies (AI Summary)

CVSS v4.0

9.9

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Name of the Vulnerable Software and Affected Versions Parse Dashboard versions 7.3.0-alpha.42 through 9.0.0-alpha.7

Description Parse Dashboard, a standalone dashboard for managing Parse Server apps, contains security issues in the AI Agent API endpoint (/apps/:appId/agent). Versions 7.3.0-alpha.42 through 9.0.0-alpha.7 are affected by multiple vulnerabilities that, when combined, could allow attackers without authentication to perform arbitrary read and write operations on any connected Parse Server database using the master key. The agent feature must be enabled for the dashboard to be affected. The issue stems from a lack of authentication, Cross-Site Request Forgery (CSRF) validation, and per-app authorization on the agent endpoint. A cache key collision between the master key and read-only master key also contributed to the problem.

Recommendations Versions 7.3.0-alpha.42 through 9.0.0-alpha.7: Remove or comment out the agent configuration block from your Parse Dashboard configuration.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2026-27595

GHSA-QWC3-H9MG-4582

Affected Products

Parse-Dashboard

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27595.json · Exploit
• https://github.com/parse-community/parse-dashboard/security/advisories/GHSA-qwc3-h9mg-4582 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-27595 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27595 · Security Note
• https://osv.dev/vulnerability/GHSA-qwc3-h9mg-4582 · Vendor Advisory
• https://github.com/parse-community/parse-dashboard/releases/tag/9.0.0-alpha.8 · Note
• https://github.com/parse-community/parse-dashboard · Note
• https://github.com/parse-community/parse-dashboard/commit/f92a9ef5246d57e51696bd881a15f3b133b2bb50 · Note
• https://t.me/cveNotify/153568 · Telegram Post
• https://twitter.com/pulsepatchio/status/2027396369040752703 · Twitter Post
• https://twitter.com/cracbot/status/2028425184517267905 · Twitter Post
• https://twitter.com/CVEnew/status/2026641372967485705 · Twitter Post
• https://t.me/cveNotify/153086 · Telegram Post