PT-2026-21836 · Parse · Parse-Dashboard

Byamb4 · Published 2026-02-25 · Updated 2026-03-02 · CVE-2026-27608

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Name of the Vulnerable Software and Affected Versions Parse Dashboard versions 7.3.0-alpha.42 through 9.0.0-alpha.7

Description Parse Dashboard, a standalone dashboard for managing Parse Server apps, contains an issue where the AI Agent API endpoint (POST /apps/:appId) lacks proper authorization checks. Authenticated users with access to specific applications can access the agent endpoint of any other application by modifying the appId in the URL. Read-only users are granted the full master key instead of the read-only master key, enabling them to perform write and delete operations by including write permissions in the request body. Only dashboards with the agent configuration enabled are affected.

Recommendations Update to version 9.0.0-alpha.8 or later. As a workaround, remove the agent configuration block from your dashboard configuration.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-27608

GHSA-CVWJ-6C9H-JG6V

Affected Products

Parse-Dashboard

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27608.json · Exploit
• https://github.com/parse-community/parse-dashboard/security/advisories/GHSA-cvwj-6c9h-jg6v · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27608 · Security Note
• https://osv.dev/vulnerability/GHSA-cvwj-6c9h-jg6v · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-27608 · Vendor Advisory
• https://github.com/parse-community/parse-dashboard/releases/tag/9.0.0-alpha.8 · Note
• https://github.com/parse-community/parse-dashboard · Note
• https://twitter.com/pulsepatchio/status/2027396178254475506 · Twitter Post
• https://t.me/cveNotify/153089 · Telegram Post
• https://twitter.com/cracbot/status/2028425190133399925 · Twitter Post
• https://twitter.com/CVEnew/status/2026641376327110772 · Twitter Post