{"data":{"id":"3a0ceb7d-acb6-41c1-bed5-aeb100acbcc2","title":"CVE-2026-27595: Parse Dashboard is a standalone dashboard for managing Parse Server apps. In versions 7.3.0-alpha.42 through…","summary":"Parse Dashboard versions 7.3.0-alpha.42 through 9.0.0-alpha.7 expose an AI Agent API endpoint, POST `/apps/:appId/agent`, that contains multiple chained security vulnerabilities. Unauthenticated remote attackers can use them to perform arbitrary read and write operations against any connected Parse Server database with the master key. The agent feature is opt-in, so dashboards without an agent config are not affected.","solution":"Fixed in 9.0.0-alpha.8, which adds authentication, CSRF validation, and per-app authorization middleware to the agent endpoint, restricts read-only users to the `readOnlyMasterKey` with write permissions stripped server-side, and corrects a cache key collision between master key and read-only master key. Workaround: remove or comment out the agent configuration block from your Parse Dashboard configuration.","labels":["security","industry"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-27595","publishedAt":"2026-02-25T03:16:04.437Z","cveId":"CVE-2026-27595","cweIds":["CWE-306"],"cvssScore":null,"cvssSeverity":null,"severity":"critical","attackType":["jailbreak","other"],"issueType":"vulnerability","affectedPackages":["parse-dashboard@>= 7.3.0-alpha.42, < 9.0.0-alpha.8 (fixed: 9.0.0-alpha.8)"],"affectedPackageNames":["parse-dashboard"],"affectedPackageRefs":["npm:parse-dashboard"],"affectedVendors":[],"affectedVendorsRaw":["Parse Dashboard AI Agent API","Parse Server"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Parse Dashboard unauthenticated access to database via AI Agent API endpoint","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00511,"epssCheckedAt":"2026-11-04T06:10:13.969Z","kevDateAdded":null,"advisoryAliases":["GHSA-qwc3-h9mg-4582"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:50:44.233Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2026-02-19T22:25:03.745Z","daysToFix":-6,"fixCheckedAt":"2026-10-29T21:40:38.468Z","capecIds":["CAPEC-115"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity"],"aiComponentTargeted":"agent","llmSpecific":false,"classifierConfidence":0.8,"researchCategory":null,"atlasIds":["AML.T0054"],"fixes":[{"ecosystem":"npm","name":"parse-dashboard","fixedVersion":"9.0.0-alpha.8","matchedVersion":"9.0.0-alpha.8","fixReleasedAt":"2026-02-19T22:25:03.745Z","daysToFix":-6,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:40:38.320Z"}]}}