CVE-2026-27608

Katalog CVE

CVSS 8.1 · High EPSS 0,38%

Kerentanan Missing Authorization pada parseplatform parse dashboard. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

Parse Dashboard is a standalone dashboard for managing Parse Server apps. In versions 7.3.0-alpha.42 through 9.0.0-alpha.7, the AI Agent API endpoint (`POST /apps/:appId/agent`) does not enforce authorization. Authenticated users scoped to specific apps can access any other app's agent endpoint by changing the app ID in the URL. Read-only users are given the full master key instead of the read-only master key and can supply write permissions in the request body to perform write and delete operations. Only dashboards with `agent` configuration enabled are affected. The fix in version 9.0.0-alpha.8 adds per-app authorization checks and restricts read-only users to the `readOnlyMasterKey` with write permissions stripped server-side. As a workaround, remove the `agent` configuration block from your dashboard configuration. Dashboards without an `agent` config are not affected.

Rincian

Terbit di NVD

25 Februari 2026

Terakhir diubah

26 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-862: Missing Authorization

EPSS (30 hari)

0,38% peluang dieksploitasi; lebih tinggi dari 29,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD. Ditampilkan 60 dari 135 konfigurasi; daftar lengkap ada di NVD.

Referensi dan perbaikan

• https://github.com/parse-community/parse-dashboard/security/advisories/GHSA-cvwj-6c9h-jg6v advisory vendor
• https://github.com/parse-community/parse-dashboard/releases/tag/9.0.0-alpha.8 release notes