CVE-2026-27608

The vulnerability consists of missing permission checks (CWE-862 — Missing Authorization) in the `POST /apps/:appId/agent` endpoint. An authenticated user assigned to a specific application can modify the `appId` parameter in the request URL, thereby gaining access to the agent of any other application. Additionally, users with read-only access receive the full master key instead of a restricted `readOnlyMasterKey`, which allows them to send parameters in the request body that grant write and delete permissions. The issue only affects installations where the `agent` block configuration is active in the dashboard settings.

An attacker can gain unauthorized access to data of any application managed by the dashboard, as well as perform write and delete operations while bypassing assigned permission restrictions.

Parse Dashboard should be updated to version 9.0.0-alpha.8 or newer, which introduces per-application permission verification and restricts read-only users to the `readOnlyMasterKey` with server-side removal of write permissions. As a workaround without updating: remove the `agent` configuration block from the dashboard configuration file — installations without this configuration are not vulnerable.

Parseplatform Parse Dashboard in versions from 7.3.0-alpha.42 to 9.0.0-alpha.7 (inclusive) with enabled `agent` block configuration