CVE-2026-27608

Parse Dashboard is a standalone dashboard for managing Parse Server apps. In versions 7.3.0-alpha.42 through 9.0.0-alpha.7, the AI Agent API endpoint (`POST /apps/:appId/agent`) does not enforce authorization. Authenticated users scoped to specific apps can access any other app's agent endpoint by changing the app ID in the URL. Read-only users are given the full master key instead of the read-only master key and can supply write permissions in the request body to perform write and delete operations. Only dashboards with `agent` configuration enabled are affected. The fix in version 9.0.0-alpha.8 adds per-app authorization checks and restricts read-only users to the `readOnlyMasterKey` with write permissions stripped server-side. As a workaround, remove the `agent` configuration block from your dashboard configuration. Dashboards without an `agent` config are not affected.

• CWE-862

• https://github.com/parse-community/parse-dashboard/releases/tag/9.0.0-alpha.8Release Notes
• https://github.com/parse-community/parse-dashboard/security/advisories/GHSA-cvwj-6c9h-jg6vVendor Advisory

Published

Feb 25, 2026

Last Modified

Jun 26, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-27602Modoboa is a mail hosting and management platform. Prior to …7.2
• CVE-2026-27603Chartbrew is an open-source web application that can connect…7.5
• CVE-2026-27604FOSSBilling is a free, open-source billing and client manage…10
• CVE-2026-27605Chartbrew is an open-source web application that can connect…5.4
• CVE-2026-27606Rollup is a module bundler for JavaScript. Versions prior to…9.8
• CVE-2026-27607RustFS is a distributed object storage system built in Rust.…9.1
• CVE-2026-27609Parse Dashboard is a standalone dashboard for managing Parse…6.5
• CVE-2026-2761Sandbox escape in the Graphics: WebRender component. This vu…10
• CVE-2026-27610Parse Dashboard is a standalone dashboard for managing Parse…5.3
• CVE-2026-27611FileBrowser Quantum is a free, self-hosted, web-based file m…6.5
• CVE-2026-27612Repostat is a React component to fetch and display GitHub re…6.1
• CVE-2026-27613TinyWeb is a web server (HTTP, HTTPS) written in Delphi for …9.8