Loading...
Skip to main content
GeekWala

CVE-2026-27608 — Vulnerability in parse-dashboard — CVE Details

CRITICAL

Parse Dashboard is Missing Authorization for its Agent Endpoint

Published February 25, 2026Updated February 25, 2026Source: osv

Summary

### Impact The AI Agent API endpoint (`POST /apps/:appId/agent`) does not enforce authorization. Authenticated users scoped to specific apps can access any other app's agent endpoint by changing the app ID in the URL. Read-only users are given the full master key instead of the read-only master key and can supply write permissions in the request body to perform write and delete operations. Affected are only dashboards with `agent` configuration enabled. ### Patches The fix adds per-app authorization checks and restricts read-only users to the `readOnlyMasterKey` with write permissions stripped server-side. ### Workarounds Remove the `agent` configuration block from your dashboard configuration. Dashboards without an `agent` config are not affected. ### Resources - GitHub advisory: https://github.com/parse-community/parse-dashboard/security/advisories/GHSA-cvwj-6c9h-jg6v - Fixed in: https://github.com/parse-community/parse-dashboard/releases/tag/9.0.0-alpha.8

Advisory Timeline

  • First published February 25, 2026 (229 days ago).
  • Last revised February 25, 2026 — 0 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

npm
Update parse-dashboard to 9.0.0-alpha.8 or later
npm install parse-dashboard@9.0.0-alpha.8

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

Affects 1 ecosystem: npm (1).

PackageEcosystemAffectedFixed In
parse-dashboard
npm
All versions9.0.0-alpha.8

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

  • CWE-862
    Missing AuthorizationMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.6 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
—
Confidentiality
—
Integrity
—
Availability
—

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

References

Frequently Asked Questions

What is CVE-2026-27608?
Parse Dashboard is Missing Authorization for its Agent Endpoint This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.6/10).
How do I check if my project is affected by CVE-2026-27608?
CVE-2026-27608 affects parse-dashboard. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-27608 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
9.6

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-cvwj-6c9h-jg6v

Related CVEs

More npm advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies