GitHub Advisoryadvisory · npm
GHSA-qwc3-h9mg-4582 Parse Dashboard has incomplete authentication on AI Agent endpoint
CRITICAL
Official page ↗
- Aliases
- CVE-2026-27595
- Ecosystem
- npm
- Packages
- parse-dashboard
- Severity
- Critical
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
- Weaknesses
- CWE-306
- Reviewed
- 2026-02-25
Affected packages
• npm parse-dashboard: >= 7.3.0-alpha.42, < 9.0.0-alpha.8 → fixed in 9.0.0-alpha.8
Description
Impact
The AI Agent API endpoint (POST `/apps/:appId/agent`) lacks authentication. Unauthenticated remote attackers can send requests to the endpoint and perform arbitrary database operations against any connected Parse Server using the master key.
Patches
The fix adds authentication middleware to the agent endpoint.
Workarounds
Remove the `agent` configuration block from your dashboard configuration. Dashboards without an `agent` config are not affected.
Resources
• GitHub advisory: https://github.com/parse-community/parse-dashboard/security/advisories/GHSA-qwc3-h9mg-4582
• Fixed in: https://github.com/parse-community/parse-dashboard/releases/tag/9.0.0-alpha.8
Related
Alias · CVE (1)
- CVE-2026-27595 Parse Dashboard is a standalone dashboard for managing Parse Server apps. vulnerability
Weakness · CWE (1)
- CWE-306 Missing Authentication for Critical Functionality weakness
References
- https://github.com/parse-community/parse-dashboard/security/advisories/GHSA-qwc3-h9mg-4582 web
- https://nvd.nist.gov/vuln/detail/CVE-2026-27595 advisory
- https://github.com/parse-community/parse-dashboard/commit/f92a9ef5246d57e51696bd881a15f3b133b2bb50 web
- https://github.com/parse-community/parse-dashboard package
- https://github.com/parse-community/parse-dashboard/releases/tag/9.0.0-alpha.8 web