ZeroDay Findings
Sign inSign up

Findings

CVE-2026-27608

Parse Dashboard is a standalone dashboard for managing Parse Server apps.

Published Feb 25, 2026 · updated Jun 26, 2026 · parseplatform parse dashboard

Parse Dashboard is a standalone dashboard for managing Parse Server apps. In versions 7.3.0-alpha.42 through 9.0.0-alpha.7, the AI Agent API endpoint ( ) does not enforce authorization. Authenticated users scoped to specific apps can access any other app's agent endpoint by changing the app ID in the URL. Read-only users are given the full master key instead of the read-only master key and can supply write permissions in the request body to perform write and delete operations. Only dashboards with configuration enabled are affected. The fix in version 9.0.0-alpha.8 adds per-app authorization checks and restricts read-only users to the with write permissions stripped server-side. As a workaround, remove the configuration block from your dashboard configuration. Dashboards without an config are not affected.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Feb 25, 2026 · NIST NVD

    Detected

    Parse Dashboard is a standalone dashboard for managing Parse Server apps. In versions 7.3.0-alpha.42 through 9.0.0-alpha.7, the AI Agent API endpoint ( ) does not enforce authorization. Authenticated users scoped to specific apps can access any other app's agent endpoint by changing the app ID in the URL. Read-only users are given the full master key instead of the read-only master key and can sup

  2. Jun 26, 2026 · NIST NVD

    Updated

    Parse Dashboard is a standalone dashboard for managing Parse Server apps. In versions 7.3.0-alpha.42 through 9.0.0-alpha.7, the AI Agent API endpoint ( ) does not enforce authorization. Authenticated users scoped to specific apps can access any other app's agent endpoint by changing the app ID in the URL. Read-only users are given the full master key instead of the read-only master key and can sup

Affected

  • cpe parseplatform/parse dashboard7.3.0

Sources

  • CVE.orgVulnerability recordCVE-2026-27608

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-27608

    Parse Dashboard is a standalone dashboard for managing Parse Server apps. In versions 7.3.0-alpha.42 through 9.0.0-alpha.7, the AI Agent API endpoint ( ) does not enforce authorization. Authenticated users scoped to specific apps can access any other app's

    nvd.nist.gov

References