CVE-2026-27608: Parse Dashboard Missing Authorization on Agent Endpoint

Published Feb 25, 2026
·
Updated

Impact

The AI Agent API endpoint (POST /apps/:appId/agent) does not enforce authorization. Authenticated users scoped to specific apps can access any other app's agent endpoint by changing the app ID in the URL. Read-only users are given the full master key instead of the read-only master key and can supply write permissions in the request body to perform write and delete operations.

Affected are only dashboards with agent configuration enabled.

Patches

The fix adds per-app authorization checks and restricts read-only users to the readOnlyMasterKey with write permissions stripped server-side.

Workarounds

Remove the agent configuration block from your dashboard configuration. Dashboards without an agent config are not affected.

Resources

- GitHub advisory: https://github.com/parse-community/parse-dashboard/security/advisories/GHSA-cvwj-6c9h-jg6v - Fixed in: https://github.com/parse-community/parse-dashboard/releases/tag/9.0.0-alpha.8

Other sources

Parse Dashboard is a standalone dashboard for managing Parse Server apps. In versions 7.3.0-alpha.42 through 9.0.0-alpha.7, the AI Agent API endpoint (POST /apps/:appId/agent) does not enforce authorization. Authenticated users scoped to specific apps can access any other app's agent endpoint by changing the app ID in the URL. Read-only users are given the full master key instead of the read-only master key and can supply write permissions in the request body to perform write and delete operations. Only dashboards with agent configuration enabled are affected. The fix in version 9.0.0-alpha.8 adds per-app authorization checks and restricts read-only users to the readOnlyMasterKey with write permissions stripped server-side. As a workaround, remove the agent configuration block from your dashboard configuration. Dashboards without an agent config are not affected.

— MITRE

Affected Software

272 affected componentsFixes available
npm/parse-dashboard>=7.3.0-alpha.42<9.0.0-alpha.7
npm/parse-dashboard>=7.3.0-alpha.42<=9.0.0-alpha.7
9.0.0-alpha.8
parseplatform Parse Dashboard Node.js=7.3.0-alpha.42
parseplatform Parse Dashboard Node.js=7.3.0-alpha.43
parseplatform Parse Dashboard Node.js=7.3.0-alpha.44
parseplatform Parse Dashboard Node.js=7.3.0-alpha.5
parseplatform Parse Dashboard Node.js=7.3.0-alpha.6
parseplatform Parse Dashboard Node.js=7.3.0-alpha.7
parseplatform Parse Dashboard Node.js=7.3.0-alpha.8
parseplatform Parse Dashboard Node.js=7.3.0-alpha.9
parseplatform Parse Dashboard Node.js=7.4.0-alpha.1
parseplatform Parse Dashboard Node.js=7.4.0-alpha.2
parseplatform Parse Dashboard Node.js=7.4.0-alpha.3
parseplatform Parse Dashboard Node.js=7.4.0-alpha.4
parseplatform Parse Dashboard Node.js=7.4.0-alpha.5
parseplatform Parse Dashboard Node.js=7.5.0-alpha.1
parseplatform Parse Dashboard Node.js=7.5.0-alpha.2
parseplatform Parse Dashboard Node.js=7.6.0-alpha.1
parseplatform Parse Dashboard Node.js=7.6.0-alpha.10
parseplatform Parse Dashboard Node.js=7.6.0-alpha.11
parseplatform Parse Dashboard Node.js=7.6.0-alpha.12
parseplatform Parse Dashboard Node.js=7.6.0-alpha.13
parseplatform Parse Dashboard Node.js=7.6.0-alpha.2
parseplatform Parse Dashboard Node.js=7.6.0-alpha.3
parseplatform Parse Dashboard Node.js=7.6.0-alpha.4
parseplatform Parse Dashboard Node.js=7.6.0-alpha.5
parseplatform Parse Dashboard Node.js=7.6.0-alpha.6
parseplatform Parse Dashboard Node.js=7.6.0-alpha.7
parseplatform Parse Dashboard Node.js=7.6.0-alpha.8
parseplatform Parse Dashboard Node.js=7.6.0-alpha.9
parseplatform Parse Dashboard Node.js=8.0.0-alpha.1
parseplatform Parse Dashboard Node.js=8.0.0-alpha.2
parseplatform Parse Dashboard Node.js=8.0.0-alpha.3
parseplatform Parse Dashboard Node.js=8.0.0-alpha.4
parseplatform Parse Dashboard Node.js=8.0.0-alpha.5
parseplatform Parse Dashboard Node.js=8.0.0-alpha.6
parseplatform Parse Dashboard Node.js=8.1.0-alpha.1
parseplatform Parse Dashboard Node.js=8.1.0-alpha.10
parseplatform Parse Dashboard Node.js=8.1.0-alpha.11
parseplatform Parse Dashboard Node.js=8.1.0-alpha.12
parseplatform Parse Dashboard Node.js=8.1.0-alpha.13
parseplatform Parse Dashboard Node.js=8.1.0-alpha.2
parseplatform Parse Dashboard Node.js=8.1.0-alpha.3
parseplatform Parse Dashboard Node.js=8.1.0-alpha.4
parseplatform Parse Dashboard Node.js=8.1.0-alpha.5
parseplatform Parse Dashboard Node.js=8.1.0-alpha.6
parseplatform Parse Dashboard Node.js=8.1.0-alpha.7
parseplatform Parse Dashboard Node.js=8.1.0-alpha.8
parseplatform Parse Dashboard Node.js=8.1.0-alpha.9
parseplatform Parse Dashboard Node.js=8.1.1-alpha.1
parseplatform Parse Dashboard Node.js=8.2.0-alpha.1
parseplatform Parse Dashboard Node.js=8.2.0-alpha.10
parseplatform Parse Dashboard Node.js=8.2.0-alpha.11
parseplatform Parse Dashboard Node.js=8.2.0-alpha.12
parseplatform Parse Dashboard Node.js=8.2.0-alpha.13
parseplatform Parse Dashboard Node.js=8.2.0-alpha.14
parseplatform Parse Dashboard Node.js=8.2.0-alpha.15
parseplatform Parse Dashboard Node.js=8.2.0-alpha.16
parseplatform Parse Dashboard Node.js=8.2.0-alpha.17
parseplatform Parse Dashboard Node.js=8.2.0-alpha.18
parseplatform Parse Dashboard Node.js=8.2.0-alpha.19
parseplatform Parse Dashboard Node.js=8.2.0-alpha.2
parseplatform Parse Dashboard Node.js=8.2.0-alpha.20
parseplatform Parse Dashboard Node.js=8.2.0-alpha.21
parseplatform Parse Dashboard Node.js=8.2.0-alpha.22
parseplatform Parse Dashboard Node.js=8.2.0-alpha.23
parseplatform Parse Dashboard Node.js=8.2.0-alpha.24
parseplatform Parse Dashboard Node.js=8.2.0-alpha.25
parseplatform Parse Dashboard Node.js=8.2.0-alpha.26
parseplatform Parse Dashboard Node.js=8.2.0-alpha.27
parseplatform Parse Dashboard Node.js=8.2.0-alpha.3
parseplatform Parse Dashboard Node.js=8.2.0-alpha.4
parseplatform Parse Dashboard Node.js=8.2.0-alpha.5
parseplatform Parse Dashboard Node.js=8.2.0-alpha.6
parseplatform Parse Dashboard Node.js=8.2.0-alpha.7
parseplatform Parse Dashboard Node.js=8.2.0-alpha.8
parseplatform Parse Dashboard Node.js=8.2.0-alpha.9
parseplatform Parse Dashboard Node.js=8.3.0-alpha.1
parseplatform Parse Dashboard Node.js=8.3.0-alpha.10
parseplatform Parse Dashboard Node.js=8.3.0-alpha.11
parseplatform Parse Dashboard Node.js=8.3.0-alpha.12
parseplatform Parse Dashboard Node.js=8.3.0-alpha.13
parseplatform Parse Dashboard Node.js=8.3.0-alpha.14
parseplatform Parse Dashboard Node.js=8.3.0-alpha.15
parseplatform Parse Dashboard Node.js=8.3.0-alpha.16
parseplatform Parse Dashboard Node.js=8.3.0-alpha.17
parseplatform Parse Dashboard Node.js=8.3.0-alpha.18
parseplatform Parse Dashboard Node.js=8.3.0-alpha.19
parseplatform Parse Dashboard Node.js=8.3.0-alpha.2
parseplatform Parse Dashboard Node.js=8.3.0-alpha.20
parseplatform Parse Dashboard Node.js=8.3.0-alpha.21
parseplatform Parse Dashboard Node.js=8.3.0-alpha.22
parseplatform Parse Dashboard Node.js=8.3.0-alpha.23
parseplatform Parse Dashboard Node.js=8.3.0-alpha.24
parseplatform Parse Dashboard Node.js=8.3.0-alpha.25
parseplatform Parse Dashboard Node.js=8.3.0-alpha.26
parseplatform Parse Dashboard Node.js=8.3.0-alpha.27
parseplatform Parse Dashboard Node.js=8.3.0-alpha.28
parseplatform Parse Dashboard Node.js=8.3.0-alpha.29
parseplatform Parse Dashboard Node.js=8.3.0-alpha.3
parseplatform Parse Dashboard Node.js=8.3.0-alpha.30
parseplatform Parse Dashboard Node.js=8.3.0-alpha.31
parseplatform Parse Dashboard Node.js=8.3.0-alpha.32
parseplatform Parse Dashboard Node.js=8.3.0-alpha.33
parseplatform Parse Dashboard Node.js=8.3.0-alpha.34
parseplatform Parse Dashboard Node.js=8.3.0-alpha.35
parseplatform Parse Dashboard Node.js=8.3.0-alpha.36
parseplatform Parse Dashboard Node.js=8.3.0-alpha.37
parseplatform Parse Dashboard Node.js=8.3.0-alpha.38
parseplatform Parse Dashboard Node.js=8.3.0-alpha.39
parseplatform Parse Dashboard Node.js=8.3.0-alpha.4
parseplatform Parse Dashboard Node.js=8.3.0-alpha.40
parseplatform Parse Dashboard Node.js=8.3.0-alpha.41
parseplatform Parse Dashboard Node.js=8.3.0-alpha.42
parseplatform Parse Dashboard Node.js=8.3.0-alpha.43
parseplatform Parse Dashboard Node.js=8.3.0-alpha.5
parseplatform Parse Dashboard Node.js=8.3.0-alpha.6
parseplatform Parse Dashboard Node.js=8.3.0-alpha.7
parseplatform Parse Dashboard Node.js=8.3.0-alpha.8
parseplatform Parse Dashboard Node.js=8.3.0-alpha.9
parseplatform Parse Dashboard Node.js=8.4.0-alpha.1
parseplatform Parse Dashboard Node.js=8.4.1-alpha.1
parseplatform Parse Dashboard Node.js=8.4.1-alpha.2
parseplatform Parse Dashboard Node.js=8.5.0-alpha.1
parseplatform Parse Dashboard Node.js=8.5.0-alpha.2
parseplatform Parse Dashboard Node.js=8.5.0-alpha.3
parseplatform Parse Dashboard Node.js=8.5.0-alpha.4
parseplatform Parse Dashboard Node.js=8.5.0-alpha.5
parseplatform Parse Dashboard Node.js=8.5.0-alpha.6
parseplatform Parse Dashboard Node.js=8.5.0-alpha.7
parseplatform Parse Dashboard Node.js=9.0.0-alpha.1
parseplatform Parse Dashboard Node.js=9.0.0-alpha.2
parseplatform Parse Dashboard Node.js=9.0.0-alpha.3
parseplatform Parse Dashboard Node.js=9.0.0-alpha.4
parseplatform Parse Dashboard Node.js=9.0.0-alpha.5
parseplatform Parse Dashboard Node.js=9.0.0-alpha.6
parseplatform Parse Dashboard Node.js=9.0.0-alpha.7
parseplatform Parse Dashboard Node.js=7.3.0-alpha42
parseplatform Parse Dashboard Node.js=7.3.0-alpha43
parseplatform Parse Dashboard Node.js=7.3.0-alpha44
parseplatform Parse Dashboard Node.js=7.3.0-alpha5
parseplatform Parse Dashboard Node.js=7.3.0-alpha6
parseplatform Parse Dashboard Node.js=7.3.0-alpha7
parseplatform Parse Dashboard Node.js=7.3.0-alpha8
parseplatform Parse Dashboard Node.js=7.3.0-alpha9
parseplatform Parse Dashboard Node.js=7.4.0-alpha1
parseplatform Parse Dashboard Node.js=7.4.0-alpha2
parseplatform Parse Dashboard Node.js=7.4.0-alpha3
parseplatform Parse Dashboard Node.js=7.4.0-alpha4
parseplatform Parse Dashboard Node.js=7.4.0-alpha5
parseplatform Parse Dashboard Node.js=7.5.0-alpha1
parseplatform Parse Dashboard Node.js=7.5.0-alpha2
parseplatform Parse Dashboard Node.js=7.6.0-alpha1
parseplatform Parse Dashboard Node.js=7.6.0-alpha10
parseplatform Parse Dashboard Node.js=7.6.0-alpha11
parseplatform Parse Dashboard Node.js=7.6.0-alpha12
parseplatform Parse Dashboard Node.js=7.6.0-alpha13
parseplatform Parse Dashboard Node.js=7.6.0-alpha2
parseplatform Parse Dashboard Node.js=7.6.0-alpha3
parseplatform Parse Dashboard Node.js=7.6.0-alpha4
parseplatform Parse Dashboard Node.js=7.6.0-alpha5
parseplatform Parse Dashboard Node.js=7.6.0-alpha6
parseplatform Parse Dashboard Node.js=7.6.0-alpha7
parseplatform Parse Dashboard Node.js=7.6.0-alpha8
parseplatform Parse Dashboard Node.js=7.6.0-alpha9
parseplatform Parse Dashboard Node.js=8.0.0-alpha1
parseplatform Parse Dashboard Node.js=8.0.0-alpha2
parseplatform Parse Dashboard Node.js=8.0.0-alpha3
parseplatform Parse Dashboard Node.js=8.0.0-alpha4
parseplatform Parse Dashboard Node.js=8.0.0-alpha5
parseplatform Parse Dashboard Node.js=8.0.0-alpha6
parseplatform Parse Dashboard Node.js=8.1.0-alpha1
parseplatform Parse Dashboard Node.js=8.1.0-alpha10
parseplatform Parse Dashboard Node.js=8.1.0-alpha11
parseplatform Parse Dashboard Node.js=8.1.0-alpha12
parseplatform Parse Dashboard Node.js=8.1.0-alpha13
parseplatform Parse Dashboard Node.js=8.1.0-alpha2
parseplatform Parse Dashboard Node.js=8.1.0-alpha3
parseplatform Parse Dashboard Node.js=8.1.0-alpha4
parseplatform Parse Dashboard Node.js=8.1.0-alpha5
parseplatform Parse Dashboard Node.js=8.1.0-alpha6
parseplatform Parse Dashboard Node.js=8.1.0-alpha7
parseplatform Parse Dashboard Node.js=8.1.0-alpha8
parseplatform Parse Dashboard Node.js=8.1.0-alpha9
parseplatform Parse Dashboard Node.js=8.1.1-alpha1
parseplatform Parse Dashboard Node.js=8.2.0-alpha1
parseplatform Parse Dashboard Node.js=8.2.0-alpha10
parseplatform Parse Dashboard Node.js=8.2.0-alpha11
parseplatform Parse Dashboard Node.js=8.2.0-alpha12
parseplatform Parse Dashboard Node.js=8.2.0-alpha13
parseplatform Parse Dashboard Node.js=8.2.0-alpha14
parseplatform Parse Dashboard Node.js=8.2.0-alpha15
parseplatform Parse Dashboard Node.js=8.2.0-alpha16
parseplatform Parse Dashboard Node.js=8.2.0-alpha17
parseplatform Parse Dashboard Node.js=8.2.0-alpha18
parseplatform Parse Dashboard Node.js=8.2.0-alpha19
parseplatform Parse Dashboard Node.js=8.2.0-alpha2
parseplatform Parse Dashboard Node.js=8.2.0-alpha20
parseplatform Parse Dashboard Node.js=8.2.0-alpha21
parseplatform Parse Dashboard Node.js=8.2.0-alpha22
parseplatform Parse Dashboard Node.js=8.2.0-alpha23
parseplatform Parse Dashboard Node.js=8.2.0-alpha24
parseplatform Parse Dashboard Node.js=8.2.0-alpha25
parseplatform Parse Dashboard Node.js=8.2.0-alpha26
parseplatform Parse Dashboard Node.js=8.2.0-alpha27
parseplatform Parse Dashboard Node.js=8.2.0-alpha3
parseplatform Parse Dashboard Node.js=8.2.0-alpha4
parseplatform Parse Dashboard Node.js=8.2.0-alpha5
parseplatform Parse Dashboard Node.js=8.2.0-alpha6
parseplatform Parse Dashboard Node.js=8.2.0-alpha7
parseplatform Parse Dashboard Node.js=8.2.0-alpha8
parseplatform Parse Dashboard Node.js=8.2.0-alpha9
parseplatform Parse Dashboard Node.js=8.3.0-alpha1
parseplatform Parse Dashboard Node.js=8.3.0-alpha10
parseplatform Parse Dashboard Node.js=8.3.0-alpha11
parseplatform Parse Dashboard Node.js=8.3.0-alpha12
parseplatform Parse Dashboard Node.js=8.3.0-alpha13
parseplatform Parse Dashboard Node.js=8.3.0-alpha14
parseplatform Parse Dashboard Node.js=8.3.0-alpha15
parseplatform Parse Dashboard Node.js=8.3.0-alpha16
parseplatform Parse Dashboard Node.js=8.3.0-alpha17
parseplatform Parse Dashboard Node.js=8.3.0-alpha18
parseplatform Parse Dashboard Node.js=8.3.0-alpha19
parseplatform Parse Dashboard Node.js=8.3.0-alpha2
parseplatform Parse Dashboard Node.js=8.3.0-alpha20
parseplatform Parse Dashboard Node.js=8.3.0-alpha21
parseplatform Parse Dashboard Node.js=8.3.0-alpha22
parseplatform Parse Dashboard Node.js=8.3.0-alpha23
parseplatform Parse Dashboard Node.js=8.3.0-alpha24
parseplatform Parse Dashboard Node.js=8.3.0-alpha25
parseplatform Parse Dashboard Node.js=8.3.0-alpha26
parseplatform Parse Dashboard Node.js=8.3.0-alpha27
parseplatform Parse Dashboard Node.js=8.3.0-alpha28
parseplatform Parse Dashboard Node.js=8.3.0-alpha29
parseplatform Parse Dashboard Node.js=8.3.0-alpha3
parseplatform Parse Dashboard Node.js=8.3.0-alpha30
parseplatform Parse Dashboard Node.js=8.3.0-alpha31
parseplatform Parse Dashboard Node.js=8.3.0-alpha32
parseplatform Parse Dashboard Node.js=8.3.0-alpha33
parseplatform Parse Dashboard Node.js=8.3.0-alpha34
parseplatform Parse Dashboard Node.js=8.3.0-alpha35
parseplatform Parse Dashboard Node.js=8.3.0-alpha36
parseplatform Parse Dashboard Node.js=8.3.0-alpha37
parseplatform Parse Dashboard Node.js=8.3.0-alpha38
parseplatform Parse Dashboard Node.js=8.3.0-alpha39
parseplatform Parse Dashboard Node.js=8.3.0-alpha4
parseplatform Parse Dashboard Node.js=8.3.0-alpha40
parseplatform Parse Dashboard Node.js=8.3.0-alpha41
parseplatform Parse Dashboard Node.js=8.3.0-alpha42
parseplatform Parse Dashboard Node.js=8.3.0-alpha43
parseplatform Parse Dashboard Node.js=8.3.0-alpha5
parseplatform Parse Dashboard Node.js=8.3.0-alpha6
parseplatform Parse Dashboard Node.js=8.3.0-alpha7
parseplatform Parse Dashboard Node.js=8.3.0-alpha8
parseplatform Parse Dashboard Node.js=8.3.0-alpha9
parseplatform Parse Dashboard Node.js=8.4.0-alpha1
parseplatform Parse Dashboard Node.js=8.4.1-alpha1
parseplatform Parse Dashboard Node.js=8.4.1-alpha2
parseplatform Parse Dashboard Node.js=8.5.0-alpha1
parseplatform Parse Dashboard Node.js=8.5.0-alpha2
parseplatform Parse Dashboard Node.js=8.5.0-alpha3
parseplatform Parse Dashboard Node.js=8.5.0-alpha4
parseplatform Parse Dashboard Node.js=8.5.0-alpha5
parseplatform Parse Dashboard Node.js=8.5.0-alpha6
parseplatform Parse Dashboard Node.js=8.5.0-alpha7
parseplatform Parse Dashboard Node.js=9.0.0-alpha1
parseplatform Parse Dashboard Node.js=9.0.0-alpha2
parseplatform Parse Dashboard Node.js=9.0.0-alpha3
parseplatform Parse Dashboard Node.js=9.0.0-alpha4
parseplatform Parse Dashboard Node.js=9.0.0-alpha5
parseplatform Parse Dashboard Node.js=9.0.0-alpha6
parseplatform Parse Dashboard Node.js=9.0.0-alpha7

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade npm/parse-dashboard to a version that resolves this vulnerability.

    Fixed in 9.0.0-alpha.8
  2. Upgrade

    Upgrade parse-community/parse-dashboard to a version that resolves this vulnerability.

    Fixed in 9.0.0-alpha.8
  3. Configuration

    As a workaround, remove the `agent` configuration block from your dashboard configuration. Dashboards without an `agent` config are not affected.

    Parse Dashboard agent configuration block = removed

Event History

Feb 25, 2026
CVE Published
via MITRE·02:16 AM
Data Sourced
via MITRE·02:16 AM
DescriptionWeakness
Data Sourced
via NVD·03:16 AM
DescriptionSeverityWeaknessAffected Software
Advisory Published
via GitHub·06:59 PM
Data Sourced
via GitHub·06:59 PM
DescriptionWeaknessAffected Software
Oct 1, 58139
Event
via FIRST·11:48 AM
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2026-27608?

CVE-2026-27608 has a medium severity rating as it allows unauthorized access to different application endpoints.

2

How do I fix CVE-2026-27608?

To fix CVE-2026-27608, upgrade to version 9.0.0-alpha.8 or later of Parse Dashboard.

3

What versions of Parse Dashboard are affected by CVE-2026-27608?

CVE-2026-27608 affects Parse Dashboard versions from 7.3.0-alpha.42 to 9.0.0-alpha.7.

4

Can read-only users exploit CVE-2026-27608?

Yes, read-only users can exploit CVE-2026-27608 to access other app's agent endpoints.

5

What type of vulnerability is CVE-2026-27608?

CVE-2026-27608 is an authorization vulnerability in the AI Agent API endpoint.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203