CVE-2026-27595

Deeper analysis

CVE-2026-27595 is a vulnerability in Parse Dashboard, a standalone dashboard for managing Parse Server apps, affecting versions 7.3.0-alpha.42 through 9.0.0-alpha.7. It stems from multiple security issues in the AI Agent API endpoint (POST `/apps/:appId/agent`), which can be chained to allow unauthenticated remote attackers to perform arbitrary read and write operations against any connected Parse Server database using the master key. The agent feature is opt-in, meaning dashboards without an agent configuration are not affected. The issue is classified under CWE-306 (Missing Authentication for Critical Function) with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).

Unauthenticated remote attackers can exploit the chained vulnerabilities by sending requests to the exposed agent endpoint, bypassing authentication and gaining full master key privileges. This enables complete read and write access to databases across any connected Parse Server instances managed by the dashboard, potentially leading to data exfiltration, modification, or deletion without requiring user interaction or privileges.

Mitigation is available in Parse Dashboard version 9.0.0-alpha.8, which adds authentication, CSRF validation, and per-app authorization middleware to the agent endpoint. It further restricts read-only users to the `readOnlyMasterKey` with write permissions stripped server-side and corrects a cache key collision between the master key and read-only master key. As a workaround, remove or comment out the agent configuration block from the Parse Dashboard configuration. Details are provided in the GitHub release notes (https://github.com/parse-community/parse-dashboard/releases/tag/9.0.0-alpha.8) and security advisory (https://github.com/parse-community/parse-dashboard/security/advisories/GHSA-qwc3-h9mg-4582).