Security Vulnerabilities in Parse Dashboard Affecting Multiple Versions

CVE-2026-27595

What is CVE-2026-27595?

The Parse Dashboard supports managing Parse Server applications but had vulnerabilities in the AI Agent API endpoint across multiple pre-release versions. These vulnerabilities enable potential attackers to execute unauthorized read and write operations on connected Parse Server databases, utilizing the master key. The issue stems from a lack of authentication and inappropriate handling of permissions. The resolution in version 9.0.0-alpha.8 introduces critical security measures, including adding mandatory authentication, Cross-Site Request Forgery (CSRF) validation, and application-specific authorization middleware to the agent endpoint. Notably, users with read-only access are now restricted to a dedicated read-only master key, which prevents unauthorized write operations. It is recommended to disable or remove the agent configuration from dashboards if versions below 9.0.0-alpha.8 are in use.

References