parse-community/parse-dashboard · Security
Parse Dashboard has incomplete authentication on AI Agent endpoint
- GHSA ID
- GHSA-qwc3-h9mg-4582
- CVE ID
- CVE-2026-27595
- Severity
- critical
- Published
- Updated
- CVSS v4
- 9.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
Description
Impact
The AI Agent API endpoint (POST /apps/:appId/agent) lacks authentication. Unauthenticated remote attackers can send requests to the endpoint and perform arbitrary database operations against any connected Parse Server using the master key.
Patches
The fix adds authentication middleware to the agent endpoint.
Workarounds
Remove the agent configuration block from your dashboard configuration. Dashboards without an agent config are not affected.
Resources
CWEs
- CWE-306 · Missing Authentication for Critical Function
References
- https://github.com/parse-community/parse-dashboard/security/advisories/GHSA-qwc3-h9mg-4582 ↗
- https://nvd.nist.gov/vuln/detail/CVE-2026-27595 ↗
- https://github.com/parse-community/parse-dashboard/commit/f92a9ef5246d57e51696bd881a15f3b133b2bb50 ↗
- https://github.com/parse-community/parse-dashboard/releases/tag/9.0.0-alpha.8 ↗
- https://github.com/advisories/GHSA-qwc3-h9mg-4582 ↗