VulnSocial

CVE-2026-27595Disclosure(parseplatform / parse_dashboard)

LOWCVSS 7.5 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Patch parseplatform parse_dashboard systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

Parse Dashboard is a standalone dashboard for managing Parse Server apps. In versions 7.3.0-alpha.42 through 9.0.0-alpha.7, the AI Agent API endpoint (POST `/apps/:appId/agent`) has multiple security vulnerabilities that, when chained, allow unauthenticated remote attackers to perform arbitrary read and write operations against any connected Parse Server database using the master key. The agent feature is opt-in; dashboards without an agent config are not affected. The fix in version 9.0.0-alpha.8 adds authentication, CSRF validation, and per-app authorization middleware to the agent endpoint. Read-only users are restricted to the `readOnlyMasterKey` with write permissions stripped server-side. A cache key collision between master key and read-only master key was also corrected. As a workaround, remove or comment out the agent configuration block from your Parse Dashboard configuration.

parseplatform CVEsBack to dashboard
2.0/ 10 priority

Sources & remediation

Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-306

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • parse_dashboard

Threat summary

  • Public PoC is present in monitored signal
  • Patch or workaround signal is available
  • 4 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • PoC mentioned or linked in 1 signal
  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 3 signals
  • Disclosure: 3 classified signals
  • Peaked 2d ago at 2 mentions (2026-02-25); latest day: 1
  • 4 total mentions across 3 days

Affected systems

Vendors
parseplatform
Products
parse_dashboard

13 versions affected across 1 product

Deep dive

Activity timeline4 mentions / 3d
01122Mentions · 2026-02-25: 2Mentions · 2026-02-27: 1Mentions · 2026-03-02: 1PoC Mentioned / Linked · 2026-02-27: 1Patch / Workaround · 2026-02-27: 1Technical Details · 2026-02-25: 1Technical Details · 2026-02-27: 1Technical Details · 2026-03-02: 102-2502-2703-02
Signal classification2 categories
Disclosure
375.0%
Patch
125.0%
Referenced assets4 URLs
Classification over time
DateTotalLabels
2026-02-252
Disclosure2
2026-02-271
Patch1
2026-03-021
Disclosure1
Full discourse4 posts
  • CRAC Learning - Tech@cracbot
    Disclosure

    CVE-2026-27595 (CVSS:9.9, HIGH) is Analyzed. Parse Dashboard is a standalone dashboard for managing Parse Server apps. In versions 7.3.0-alpha.42 through 9.0.0-alpha..https://nvd.nist.gov/vuln/detail/CVE-2026-27595 #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre

    Post summary

    The post announces CVE-2026-27595 with a high CVSS score and affected Parse Dashboard versions, but provides no exploit or mitigation details.

    0000023
    173 followersView on X
  • PulsePatch.io@pulsepatchio
    Patch

    Incomplete authentication on the `Parse Dashboard` AI Agent endpoint (CVE-2026-27595) allows unauthorized access. Patching to 9.0.0-alpha.8 or later is advised. #parsedashboard #authentication #infosec https://www.pulsepatch.io/posts/cve-2026-27595-parse-dashboard-auth-bypass

    Post summary

    CVE-2026-27595 permits unauthorized access via incomplete authentication on Parse Dashboard AI Agent; patching to version 9.0.0‑alpha.8 or newer is recommended.

    0000039
    1 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-27595 Parse Dashboard is a standalone dashboard for managing Parse Server apps. In versions 7.3.0-alpha.42 through 9.0.0-alpha.7, the AI Agent API endpoint (POST `/apps/:ap… https://www.cve.org/CVERecord?id=CVE-2026-27595

    Post summary

    The text announces CVE-2026-27595 affecting Parse Dashboard versions 7.3.0‑alpha.42 to 9.0.0‑alpha.7, but provides no further technical details or mitigation information.

    00000119
    56.6K followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-27595 Unauthenticated Remote Database Manipulation in Parse Dashboard 7.3.0-alpha.42 to 9.0.0-alpha.7 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-27595

    Post summary

    The post announces CVE-2026-27595, describing unauthenticated remote database manipulation in Parse Dashboard versions 7.3.0-alpha.42 to 9.0.0-alpha.7, with no mention of PoC, exploit, or patch.

    0000033
    4.0K followersView on X
CPE platform detail135 entries

135 of 135 entries

PartVendorProductVersionTarget SWTarget HW
Appparseplatformparse_dashboard7.3.0node.js-
Appparseplatformparse_dashboard7.3.0node.js-
Appparseplatformparse_dashboard7.3.0node.js-
Appparseplatformparse_dashboard7.3.0node.js-
Appparseplatformparse_dashboard7.3.0node.js-
Appparseplatformparse_dashboard7.3.0node.js-
Appparseplatformparse_dashboard7.3.0node.js-
Appparseplatformparse_dashboard7.3.0node.js-
Appparseplatformparse_dashboard7.4.0node.js-
Appparseplatformparse_dashboard7.4.0node.js-
Appparseplatformparse_dashboard7.4.0node.js-
Appparseplatformparse_dashboard7.4.0node.js-
Appparseplatformparse_dashboard7.4.0node.js-
Appparseplatformparse_dashboard7.5.0node.js-
Appparseplatformparse_dashboard7.5.0node.js-
Appparseplatformparse_dashboard7.6.0node.js-
Appparseplatformparse_dashboard7.6.0node.js-
Appparseplatformparse_dashboard7.6.0node.js-
Appparseplatformparse_dashboard7.6.0node.js-
Appparseplatformparse_dashboard7.6.0node.js-
Appparseplatformparse_dashboard7.6.0node.js-
Appparseplatformparse_dashboard7.6.0node.js-
Appparseplatformparse_dashboard7.6.0node.js-
Appparseplatformparse_dashboard7.6.0node.js-
Appparseplatformparse_dashboard7.6.0node.js-
Appparseplatformparse_dashboard7.6.0node.js-
Appparseplatformparse_dashboard7.6.0node.js-
Appparseplatformparse_dashboard7.6.0node.js-
Appparseplatformparse_dashboard8.0.0node.js-
Appparseplatformparse_dashboard8.0.0node.js-
Appparseplatformparse_dashboard8.0.0node.js-
Appparseplatformparse_dashboard8.0.0node.js-
Appparseplatformparse_dashboard8.0.0node.js-
Appparseplatformparse_dashboard8.0.0node.js-
Appparseplatformparse_dashboard8.1.0node.js-
Appparseplatformparse_dashboard8.1.0node.js-
Appparseplatformparse_dashboard8.1.0node.js-
Appparseplatformparse_dashboard8.1.0node.js-
Appparseplatformparse_dashboard8.1.0node.js-
Appparseplatformparse_dashboard8.1.0node.js-
Appparseplatformparse_dashboard8.1.0node.js-
Appparseplatformparse_dashboard8.1.0node.js-
Appparseplatformparse_dashboard8.1.0node.js-
Appparseplatformparse_dashboard8.1.0node.js-
Appparseplatformparse_dashboard8.1.0node.js-
Appparseplatformparse_dashboard8.1.0node.js-
Appparseplatformparse_dashboard8.1.0node.js-
Appparseplatformparse_dashboard8.1.1node.js-
Appparseplatformparse_dashboard8.2.0node.js-
Appparseplatformparse_dashboard8.2.0node.js-
Appparseplatformparse_dashboard8.2.0node.js-
Appparseplatformparse_dashboard8.2.0node.js-
Appparseplatformparse_dashboard8.2.0node.js-
Appparseplatformparse_dashboard8.2.0node.js-
Appparseplatformparse_dashboard8.2.0node.js-
Appparseplatformparse_dashboard8.2.0node.js-
Appparseplatformparse_dashboard8.2.0node.js-
Appparseplatformparse_dashboard8.2.0node.js-
Appparseplatformparse_dashboard8.2.0node.js-
Appparseplatformparse_dashboard8.2.0node.js-
Appparseplatformparse_dashboard8.2.0node.js-
Appparseplatformparse_dashboard8.2.0node.js-
Appparseplatformparse_dashboard8.2.0node.js-
Appparseplatformparse_dashboard8.2.0node.js-
Appparseplatformparse_dashboard8.2.0node.js-
Appparseplatformparse_dashboard8.2.0node.js-
Appparseplatformparse_dashboard8.2.0node.js-
Appparseplatformparse_dashboard8.2.0node.js-
Appparseplatformparse_dashboard8.2.0node.js-
Appparseplatformparse_dashboard8.2.0node.js-
Appparseplatformparse_dashboard8.2.0node.js-
Appparseplatformparse_dashboard8.2.0node.js-
Appparseplatformparse_dashboard8.2.0node.js-
Appparseplatformparse_dashboard8.2.0node.js-
Appparseplatformparse_dashboard8.2.0node.js-
Appparseplatformparse_dashboard8.3.0node.js-
Appparseplatformparse_dashboard8.3.0node.js-
Appparseplatformparse_dashboard8.3.0node.js-
Appparseplatformparse_dashboard8.3.0node.js-
Appparseplatformparse_dashboard8.3.0node.js-
Appparseplatformparse_dashboard8.3.0node.js-
Appparseplatformparse_dashboard8.3.0node.js-
Appparseplatformparse_dashboard8.3.0node.js-
Appparseplatformparse_dashboard8.3.0node.js-
Appparseplatformparse_dashboard8.3.0node.js-
Appparseplatformparse_dashboard8.3.0node.js-
Appparseplatformparse_dashboard8.3.0node.js-
Appparseplatformparse_dashboard8.3.0node.js-
Appparseplatformparse_dashboard8.3.0node.js-
Appparseplatformparse_dashboard8.3.0node.js-
Appparseplatformparse_dashboard8.3.0node.js-
Appparseplatformparse_dashboard8.3.0node.js-
Appparseplatformparse_dashboard8.3.0node.js-
Appparseplatformparse_dashboard8.3.0node.js-
Appparseplatformparse_dashboard8.3.0node.js-
Appparseplatformparse_dashboard8.3.0node.js-
Appparseplatformparse_dashboard8.3.0node.js-
Appparseplatformparse_dashboard8.3.0node.js-
Appparseplatformparse_dashboard8.3.0node.js-
Appparseplatformparse_dashboard8.3.0node.js-
Appparseplatformparse_dashboard8.3.0node.js-
Appparseplatformparse_dashboard8.3.0node.js-
Appparseplatformparse_dashboard8.3.0node.js-
Appparseplatformparse_dashboard8.3.0node.js-
Appparseplatformparse_dashboard8.3.0node.js-
Appparseplatformparse_dashboard8.3.0node.js-
Appparseplatformparse_dashboard8.3.0node.js-
Appparseplatformparse_dashboard8.3.0node.js-
Appparseplatformparse_dashboard8.3.0node.js-
Appparseplatformparse_dashboard8.3.0node.js-
Appparseplatformparse_dashboard8.3.0node.js-
Appparseplatformparse_dashboard8.3.0node.js-
Appparseplatformparse_dashboard8.3.0node.js-
Appparseplatformparse_dashboard8.3.0node.js-
Appparseplatformparse_dashboard8.3.0node.js-
Appparseplatformparse_dashboard8.3.0node.js-
Appparseplatformparse_dashboard8.3.0node.js-
Appparseplatformparse_dashboard8.3.0node.js-
Appparseplatformparse_dashboard8.4.0node.js-
Appparseplatformparse_dashboard8.4.1node.js-
Appparseplatformparse_dashboard8.4.1node.js-
Appparseplatformparse_dashboard8.5.0node.js-
Appparseplatformparse_dashboard8.5.0node.js-
Appparseplatformparse_dashboard8.5.0node.js-
Appparseplatformparse_dashboard8.5.0node.js-
Appparseplatformparse_dashboard8.5.0node.js-
Appparseplatformparse_dashboard8.5.0node.js-
Appparseplatformparse_dashboard8.5.0node.js-
Appparseplatformparse_dashboard9.0.0node.js-
Appparseplatformparse_dashboard9.0.0node.js-
Appparseplatformparse_dashboard9.0.0node.js-
Appparseplatformparse_dashboard9.0.0node.js-
Appparseplatformparse_dashboard9.0.0node.js-
Appparseplatformparse_dashboard9.0.0node.js-
Appparseplatformparse_dashboard9.0.0node.js-

Explore more

Back to dashboardparseplatform CVEsparse_dashboard vulnerabilities