CVE-2026-27595

Katalog CVE

CVSS 7.5 · High EPSS 0,64%

Kerentanan Missing Authentication for Critical Function pada parseplatform parse dashboard. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Parse Dashboard is a standalone dashboard for managing Parse Server apps. In versions 7.3.0-alpha.42 through 9.0.0-alpha.7, the AI Agent API endpoint (POST `/apps/:appId/agent`) has multiple security vulnerabilities that, when chained, allow unauthenticated remote attackers to perform arbitrary read and write operations against any connected Parse Server database using the master key. The agent feature is opt-in; dashboards without an agent config are not affected. The fix in version 9.0.0-alpha.8 adds authentication, CSRF validation, and per-app authorization middleware to the agent endpoint. Read-only users are restricted to the `readOnlyMasterKey` with write permissions stripped server-side. A cache key collision between master key and read-only master key was also corrected. As a workaround, remove or comment out the agent configuration block from your Parse Dashboard configuration.

Rincian

Terbit di NVD

25 Februari 2026

Terakhir diubah

26 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-306: Missing Authentication for Critical Function

EPSS (30 hari)

0,64% peluang dieksploitasi; lebih tinggi dari 49,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD. Ditampilkan 60 dari 135 konfigurasi; daftar lengkap ada di NVD.

Referensi dan perbaikan

• https://github.com/parse-community/parse-dashboard/security/advisories/GHSA-qwc3-h9mg-4582 advisory vendor
• https://github.com/parse-community/parse-dashboard/releases/tag/9.0.0-alpha.8 release notes