Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.3
Parse Dashboard Agent Endpoint Lacks Authorization
CVE-2026-27608
GHSA-cvwj-6c9h-jg6v
Summary
Parse Dashboard allows unauthorized access to app agents. If you're using the agent feature, update to the latest version (9.0.0-alpha.8) to fix the issue. Alternatively, disable the agent feature in your dashboard configuration to remove the risk.
What to do
- Update parseadmin parse-dashboard to version 9.0.0-alpha.8.
Affected software
| Vendor | Product | Affected versions | Fix available |
|---|---|---|---|
| parseadmin | parse-dashboard | > 7.3.0-alpha.42 , <= 9.0.0-alpha.7 | 9.0.0-alpha.8 |
| parseplatform | parse_dashboard | 7.3.0 | – |
| parseplatform | parse_dashboard | 7.3.0 | – |
| parseplatform | parse_dashboard | 7.3.0 | – |
| parseplatform | parse_dashboard | 7.3.0 | – |
| parseplatform | parse_dashboard | 7.3.0 | – |
| parseplatform | parse_dashboard | 7.3.0 | – |
| parseplatform | parse_dashboard | 7.3.0 | – |
| parseplatform | parse_dashboard | 7.3.0 | – |
| parseplatform | parse_dashboard | 7.4.0 | – |
| parseplatform | parse_dashboard | 7.4.0 | – |
| parseplatform | parse_dashboard | 7.4.0 | – |
| parseplatform | parse_dashboard | 7.4.0 | – |
| parseplatform | parse_dashboard | 7.4.0 | – |
| parseplatform | parse_dashboard | 7.5.0 | – |
| parseplatform | parse_dashboard | 7.5.0 | – |
| parseplatform | parse_dashboard | 7.6.0 | – |
| parseplatform | parse_dashboard | 7.6.0 | – |
| parseplatform | parse_dashboard | 7.6.0 | – |
| parseplatform | parse_dashboard | 7.6.0 | – |
| parseplatform | parse_dashboard | 7.6.0 | – |
| parseplatform | parse_dashboard | 7.6.0 | – |
| parseplatform | parse_dashboard | 7.6.0 | – |
| parseplatform | parse_dashboard | 7.6.0 | – |
| parseplatform | parse_dashboard | 7.6.0 | – |
| parseplatform | parse_dashboard | 7.6.0 | – |
| parseplatform | parse_dashboard | 7.6.0 | – |
| parseplatform | parse_dashboard | 7.6.0 | – |
| parseplatform | parse_dashboard | 7.6.0 | – |
| parseplatform | parse_dashboard | 8.0.0 | – |
| parseplatform | parse_dashboard | 8.0.0 | – |
| parseplatform | parse_dashboard | 8.0.0 | – |
| parseplatform | parse_dashboard | 8.0.0 | – |
| parseplatform | parse_dashboard | 8.0.0 | – |
| parseplatform | parse_dashboard | 8.0.0 | – |
| parseplatform | parse_dashboard | 8.1.0 | – |
| parseplatform | parse_dashboard | 8.1.0 | – |
| parseplatform | parse_dashboard | 8.1.0 | – |
| parseplatform | parse_dashboard | 8.1.0 | – |
| parseplatform | parse_dashboard | 8.1.0 | – |
| parseplatform | parse_dashboard | 8.1.0 | – |
| parseplatform | parse_dashboard | 8.1.0 | – |
| parseplatform | parse_dashboard | 8.1.0 | – |
| parseplatform | parse_dashboard | 8.1.0 | – |
| parseplatform | parse_dashboard | 8.1.0 | – |
| parseplatform | parse_dashboard | 8.1.0 | – |
| parseplatform | parse_dashboard | 8.1.0 | – |
| parseplatform | parse_dashboard | 8.1.0 | – |
| parseplatform | parse_dashboard | 8.1.1 | – |
| parseplatform | parse_dashboard | 8.2.0 | – |
| parseplatform | parse_dashboard | 8.2.0 | – |
| parseplatform | parse_dashboard | 8.2.0 | – |
| parseplatform | parse_dashboard | 8.2.0 | – |
| parseplatform | parse_dashboard | 8.2.0 | – |
| parseplatform | parse_dashboard | 8.2.0 | – |
| parseplatform | parse_dashboard | 8.2.0 | – |
| parseplatform | parse_dashboard | 8.2.0 | – |
| parseplatform | parse_dashboard | 8.2.0 | – |
| parseplatform | parse_dashboard | 8.2.0 | – |
| parseplatform | parse_dashboard | 8.2.0 | – |
| parseplatform | parse_dashboard | 8.2.0 | – |
| parseplatform | parse_dashboard | 8.2.0 | – |
| parseplatform | parse_dashboard | 8.2.0 | – |
| parseplatform | parse_dashboard | 8.2.0 | – |
| parseplatform | parse_dashboard | 8.2.0 | – |
| parseplatform | parse_dashboard | 8.2.0 | – |
| parseplatform | parse_dashboard | 8.2.0 | – |
| parseplatform | parse_dashboard | 8.2.0 | – |
| parseplatform | parse_dashboard | 8.2.0 | – |
| parseplatform | parse_dashboard | 8.2.0 | – |
| parseplatform | parse_dashboard | 8.2.0 | – |
| parseplatform | parse_dashboard | 8.2.0 | – |
| parseplatform | parse_dashboard | 8.2.0 | – |
| parseplatform | parse_dashboard | 8.2.0 | – |
| parseplatform | parse_dashboard | 8.2.0 | – |
| parseplatform | parse_dashboard | 8.2.0 | – |
| parseplatform | parse_dashboard | 8.3.0 | – |
| parseplatform | parse_dashboard | 8.3.0 | – |
| parseplatform | parse_dashboard | 8.3.0 | – |
| parseplatform | parse_dashboard | 8.3.0 | – |
| parseplatform | parse_dashboard | 8.3.0 | – |
| parseplatform | parse_dashboard | 8.3.0 | – |
| parseplatform | parse_dashboard | 8.3.0 | – |
| parseplatform | parse_dashboard | 8.3.0 | – |
| parseplatform | parse_dashboard | 8.3.0 | – |
| parseplatform | parse_dashboard | 8.3.0 | – |
| parseplatform | parse_dashboard | 8.3.0 | – |
| parseplatform | parse_dashboard | 8.3.0 | – |
| parseplatform | parse_dashboard | 8.3.0 | – |
| parseplatform | parse_dashboard | 8.3.0 | – |
| parseplatform | parse_dashboard | 8.3.0 | – |
| parseplatform | parse_dashboard | 8.3.0 | – |
| parseplatform | parse_dashboard | 8.3.0 | – |
| parseplatform | parse_dashboard | 8.3.0 | – |
| parseplatform | parse_dashboard | 8.3.0 | – |
| parseplatform | parse_dashboard | 8.3.0 | – |
| parseplatform | parse_dashboard | 8.3.0 | – |
| parseplatform | parse_dashboard | 8.3.0 | – |
| parseplatform | parse_dashboard | 8.3.0 | – |
| parseplatform | parse_dashboard | 8.3.0 | – |
| parseplatform | parse_dashboard | 8.3.0 | – |
| parseplatform | parse_dashboard | 8.3.0 | – |
| parseplatform | parse_dashboard | 8.3.0 | – |
| parseplatform | parse_dashboard | 8.3.0 | – |
| parseplatform | parse_dashboard | 8.3.0 | – |
| parseplatform | parse_dashboard | 8.3.0 | – |
| parseplatform | parse_dashboard | 8.3.0 | – |
| parseplatform | parse_dashboard | 8.3.0 | – |
| parseplatform | parse_dashboard | 8.3.0 | – |
| parseplatform | parse_dashboard | 8.3.0 | – |
| parseplatform | parse_dashboard | 8.3.0 | – |
| parseplatform | parse_dashboard | 8.3.0 | – |
| parseplatform | parse_dashboard | 8.3.0 | – |
| parseplatform | parse_dashboard | 8.3.0 | – |
| parseplatform | parse_dashboard | 8.3.0 | – |
| parseplatform | parse_dashboard | 8.3.0 | – |
| parseplatform | parse_dashboard | 8.3.0 | – |
| parseplatform | parse_dashboard | 8.3.0 | – |
| parseplatform | parse_dashboard | 8.3.0 | – |
| parseplatform | parse_dashboard | 8.4.0 | – |
| parseplatform | parse_dashboard | 8.4.1 | – |
| parseplatform | parse_dashboard | 8.4.1 | – |
| parseplatform | parse_dashboard | 8.5.0 | – |
| parseplatform | parse_dashboard | 8.5.0 | – |
| parseplatform | parse_dashboard | 8.5.0 | – |
| parseplatform | parse_dashboard | 8.5.0 | – |
| parseplatform | parse_dashboard | 8.5.0 | – |
| parseplatform | parse_dashboard | 8.5.0 | – |
| parseplatform | parse_dashboard | 8.5.0 | – |
| parseplatform | parse_dashboard | 9.0.0 | – |
| parseplatform | parse_dashboard | 9.0.0 | – |
| parseplatform | parse_dashboard | 9.0.0 | – |
| parseplatform | parse_dashboard | 9.0.0 | – |
| parseplatform | parse_dashboard | 9.0.0 | – |
| parseplatform | parse_dashboard | 9.0.0 | – |
| parseplatform | parse_dashboard | 9.0.0 | – |
Original title
Parse Dashboard is Missing Authorization for its Agent Endpoint
Original description
### Impact
The AI Agent API endpoint (`POST /apps/:appId/agent`) does not enforce authorization. Authenticated users scoped to specific apps can access any other app's agent endpoint by changing the app ID in the URL. Read-only users are given the full master key instead of the read-only master key and can supply write permissions in the request body to perform write and delete operations.
Affected are only dashboards with `agent` configuration enabled.
### Patches
The fix adds per-app authorization checks and restricts read-only users to the `readOnlyMasterKey` with write permissions stripped server-side.
### Workarounds
Remove the `agent` configuration block from your dashboard configuration. Dashboards without an `agent` config are not affected.
### Resources
- GitHub advisory: https://github.com/parse-community/parse-dashboard/security/advisories/GHSA-cvwj-6c9h-jg6v
- Fixed in: https://github.com/parse-community/parse-dashboard/releases/tag/9.0.0-alpha.8
The AI Agent API endpoint (`POST /apps/:appId/agent`) does not enforce authorization. Authenticated users scoped to specific apps can access any other app's agent endpoint by changing the app ID in the URL. Read-only users are given the full master key instead of the read-only master key and can supply write permissions in the request body to perform write and delete operations.
Affected are only dashboards with `agent` configuration enabled.
### Patches
The fix adds per-app authorization checks and restricts read-only users to the `readOnlyMasterKey` with write permissions stripped server-side.
### Workarounds
Remove the `agent` configuration block from your dashboard configuration. Dashboards without an `agent` config are not affected.
### Resources
- GitHub advisory: https://github.com/parse-community/parse-dashboard/security/advisories/GHSA-cvwj-6c9h-jg6v
- Fixed in: https://github.com/parse-community/parse-dashboard/releases/tag/9.0.0-alpha.8
nvd CVSS3.1
8.1
nvd CVSS4.0
9.3
Vulnerability type
CWE-862
Missing Authorization
Published: 25 Feb 2026 · Updated: 12 Mar 2026 · First seen: 6 Mar 2026