Parse Dashboard is Missing Authorization for its Agent Endpoint

Description

The AI Agent API endpoint (POST /apps/:appId/agent) does not enforce authorization. Authenticated users scoped to specific apps can access any other app’s agent endpoint by changing the app ID in the URL.

Recommendation

Update the parse-dashboard package to the latest compatible version. Followings are version details:

• Affected version(s): >= 7.3.0-alpha.42, <= 9.0.0-alpha.7
• Patched version(s): 9.0.0-alpha.8

References

• GHSA-cvwj-6c9h-jg6v
• CVE-2026-27608
• CWE-862
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Parse Dashboard is Missing CSRF Protection for its Agent Endpoint - CVE-2026-27609
• Parse Dashboard has incomplete authentication on AI Agent endpoint - CVE-2026-27595
• Parse Server: File metadata endpoint bypasses `beforeFind` / `afterFind` trigger authorization - CVE-2026-30850
• Parse Dashboard Has a Cache Key Collision that Leaks Master Key to Read-Only Sessions - CVE-2026-27610

Tags:

npm

parse-dashboard