CVE-2026-27608 Parse Dashboard Missing Authorization on Agent Endpoint
Authenticated users can access other apps' agent endpoints and perform write operations due to missing authorization checks in Parse Dashboard.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-27608?
CVE-2026-27608 is a critical missing authorization vulnerability in parse-community parse-dashboard, published on 25 Feb 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Parse Dashboard is a standalone dashboard for managing Parse Server apps. In versions 7.3.0-alpha.42 through 9.0.0-alpha.7, the AI Agent API endpoint (`POST /apps/:appId/agent`) does not enforce authorization. Authenticated users scoped to specific apps can access any other app's agent endpoint by changing the app ID in the URL. Read-only users are given the full master key instead of the read-only master key and can supply write permissions in the request body to perform write and delete operations. Only dashboards with `agent` configuration enabled are affected. The fix in version 9.0.0-alpha.8 adds per-app authorization checks and restricts read-only users to the `readOnlyMasterKey` with write permissions stripped server-side. As a workaround, remove the `agent` configuration block from your dashboard configuration. Dashboards without an `agent` config are not affected.
Weakness: CWE-862
Which versions are affected by CVE-2026-27608?
2 open source packages ship an affected version, including parse-dashboard. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
parse-dashboard npm | From 7.3.0-alpha.42 | 9.0.0-alpha.8 |
parse-dashboard npm | From 7.3.0-alpha.42 | 9.0.0-alpha.8 |
Products include Parseplatform Parse Dashboard.
How do I fix CVE-2026-27608?
Upgrade parse-dashboard to 9.0.0-alpha.8 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-27608 being exploited?
There is no known exploitation of CVE-2026-27608 in the wild and no public exploit code.
Other vulnerabilities in parse-community parse-dashboard
Sources
Also known as GHSA-cvwj-6c9h-jg6v.