CVE-2026-27608: Parse Dashboard AI Agent API endpoint lacks authorization checks across apps
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2026-27608
- Published
- Record updated
- Affected
- parse-dashboard >= 7.3.0-alpha.42, <= 9.0.0-alpha.7
- Fixed in
- 9.0.0-alpha.8
- released February 19, 2026, 6 days before disclosure
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.3%
Summary
CVE-2026-27608 affects Parse Dashboard, a standalone dashboard for managing Parse Server apps, in versions 7.3.0-alpha.42 through 9.0.0-alpha.7. The AI Agent API endpoint (`POST /apps/:appId/agent`) does not enforce authorization, so an authenticated user scoped to one app can reach another app's agent endpoint by changing the app ID in the URL. Read-only users receive the full master key instead of the read-only master key and can add write permissions in the request body to perform write and delete operations. Only dashboards with `agent` configuration enabled are affected.
Mitigation
Fixed in 9.0.0-alpha.8, which adds per-app authorization checks and restricts read-only users to the `readOnlyMasterKey` with write permissions stripped server-side. As a workaround, remove the `agent` configuration block from your dashboard configuration; dashboards without an `agent` config are not affected.