{"data":{"id":"5c0d653a-61c1-4e2c-8603-234b2e2b7fb0","title":"CVE-2026-27608: Parse Dashboard is a standalone dashboard for managing Parse Server apps. In versions 7.3.0-alpha.42 through…","summary":"CVE-2026-27608 affects Parse Dashboard, a standalone dashboard for managing Parse Server apps, in versions 7.3.0-alpha.42 through 9.0.0-alpha.7. The AI Agent API endpoint (`POST /apps/:appId/agent`) does not enforce authorization, so an authenticated user scoped to one app can reach another app's agent endpoint by changing the app ID in the URL. Read-only users receive the full master key instead of the read-only master key and can add write permissions in the request body to perform write and delete operations. Only dashboards with `agent` configuration enabled are affected.","solution":"Fixed in 9.0.0-alpha.8, which adds per-app authorization checks and restricts read-only users to the `readOnlyMasterKey` with write permissions stripped server-side. As a workaround, remove the `agent` configuration block from your dashboard configuration; dashboards without an `agent` config are not affected.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-27608","publishedAt":"2026-02-25T03:16:04.960Z","cveId":"CVE-2026-27608","cweIds":["CWE-862"],"cvssScore":null,"cvssSeverity":null,"severity":"high","attackType":[],"issueType":"vulnerability","affectedPackages":["parse-dashboard@>= 7.3.0-alpha.42, <= 9.0.0-alpha.7 (fixed: 9.0.0-alpha.8)"],"affectedPackageNames":["parse-dashboard"],"affectedPackageRefs":["npm:parse-dashboard"],"affectedVendors":[],"affectedVendorsRaw":["Parse Dashboard AI Agent API","Parse Server"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Parse Dashboard AI Agent API endpoint lacks authorization checks across apps","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00258,"epssCheckedAt":"2026-11-04T06:10:15.237Z","kevDateAdded":null,"advisoryAliases":["GHSA-cvwj-6c9h-jg6v"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:50:43.735Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2026-02-19T22:25:03.745Z","daysToFix":-6,"fixCheckedAt":"2026-10-29T21:40:37.644Z","capecIds":["CAPEC-122"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity"],"aiComponentTargeted":"agent","llmSpecific":false,"classifierConfidence":0.8,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"npm","name":"parse-dashboard","fixedVersion":"9.0.0-alpha.8","matchedVersion":"9.0.0-alpha.8","fixReleasedAt":"2026-02-19T22:25:03.745Z","daysToFix":-6,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:40:37.497Z"}]}}