Authorization Bypass in Parse Dashboard by Parse Community

CVE-2026-27608

What is CVE-2026-27608?

A security flaw in Parse Dashboard allows authenticated users to access unauthorized app agent endpoints. This vulnerability, present in versions 7.3.0-alpha.42 through 9.0.0-alpha.7, enables users scoped to specific applications to manipulate the app ID in requests, potentially compromising app security. Notably, read-only users receive elevated permissions, including access to a full master key, permitting write and delete operations unbounded by their intended access levels. As a remedy, users are advised to upgrade to version 9.0.0-alpha.8 or higher, which implements necessary authorization checks, limiting access appropriately. If upgrading is not feasible, it is recommended to remove the agent configuration block from dashboard settings, as it exposes the application to further risks.

References