CVE-2026-27608
highPriorität · verfolgen · 32OT-Risiko · erhöhtEPSS 0.003 · 17. PerzentilEUUSEPSS · bewertet 2026-10-27
Parse Dashboard is a standalone dashboard for managing Parse Server apps. In versions 7.3.0-alpha.42 through 9.0.0-alpha.7, the AI Agent API endpoint (`POST /apps/:appId/agent`) does not enforce authorization. Authenticated users scoped to specific apps can access any other app's agent endpoint by changing the app ID in the URL. Read-only users are given the full master key instead of the read-only master key and can supply write permissions in the request body to perform write and delete operations. Only dashboards with `agent` configuration enabled are affected. The fix in version 9.0.0-alpha.8 adds per-app authorization checks and restricts read-only users to the `readOnlyMasterKey` with write permissions stripped server-side. As a workaround, remove the `agent` configuration block from your dashboard configuration. Dashboards without an `agent` config are not affected.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · high–critical · 7.5–9.3
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (15)
Betroffene Produkte und Versionsbereiche.
Advisories (1)
Hersteller- und Ökosystem-Meldungen dazu.
- GHSA-cvwj-6c9h-jg6vParse Dashboard is Missing Authorization for its Agent Endpoint2026-02-25ghsa · osvUS
### Impact The AI Agent API endpoint (`POST /apps/:appId/agent`) does not enforce authorization. Authenticated users scoped to specific apps can access any other app's agent endpoint by changing the app ID in the URL. Read-only users are given the full master key instead of the read-only master key and can supply write permissions in the request body to perform write and delete operations. Affected are only dashboards with `agent` configuration enabled. ### Patches The fix adds per-app authorization checks and restricts read-only users to the `readOnlyMasterKey` with write permissions stripped server-side. ### Workarounds Remove the `agent` configuration block from your dashboard configuration. Dashboards without an `agent` config are not affected. ### Resources - GitHub advisory: https://github.com/parse-community/parse-dashboard/security/advisories/GHSA-cvwj-6c9h-jg6v - Fixed in: https://github.com/parse-community/parse-dashboard/releases/tag/9.0.0-alpha.8
auch bekannt als (3)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (7)
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/parse-community/parse-dashboard/releases/Patchcnnvd
- https://github.com/parse-community/parse-dashboard/releases/tag/9.0.0-alpha.8cnnvd
- https://github.com/parse-community/parse-dashboard/security/advisories/GHSA-cvwj-6c9h-jg6vcnnvd
- https://github.com/parse-community/parse-dashboard/releases/tag/9.0.0-alpha.8enisa_euvd
- https://github.com/parse-community/parse-dashboard/security/advisories/GHSA-cvwj-6c9h-jg6venisa_euvd
- https://github.com/parse-community/parse-dashboard/releases/tag/9.0.0-alpha.8Release Notesnvd
- https://github.com/parse-community/parse-dashboard/security/advisories/GHSA-cvwj-6c9h-jg6vVendor Advisorynvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan