Parse Dashboard is a management interface for Parse Server applications. Versions 7.3.0-alpha.42 through 9.0.0-alpha.7 contain a critical security flaw in the AI Agent API endpoint (POST `/apps/:appId/agent`). This endpoint lacks proper authentication controls, allowing unauthenticated remote attackers to chain multiple vulnerabilities to gain full read and write access to any connected Parse Server database by leveraging the master key. The vulnerability is categorized under CWE-306 (Missing Authentication for Critical Function). Additionally, a cache key collision between the master key and the read-only master key allowed privilege escalation. The agent feature is optional and must be configured to be active; dashboards without this configuration are not vulnerable. The fix introduced in version 9.0.0-alpha.8 includes robust authentication mechanisms, CSRF protections, and per-application authorization middleware, restricting read-only users to a read-only master key with server-side write permission removal. The vulnerability has a CVSS 4.0 score of 9.9, indicating critical severity due to network exploitable, no authentication required, no user interaction, and high impact on confidentiality and integrity. No known exploits are reported in the wild yet, but the potential for severe damage is significant.

This vulnerability allows unauthenticated attackers to fully compromise the confidentiality and integrity of Parse Server databases connected to vulnerable parse-dashboard instances. Attackers can read sensitive data, modify or delete records, and potentially disrupt application functionality. Because the master key is exposed through this flaw, attackers effectively gain administrative control over the backend data store. This can lead to data breaches, data loss, unauthorized data manipulation, and service disruption. Organizations relying on parse-dashboard for managing Parse Server apps, especially those with sensitive or critical data, face significant risk. The lack of authentication and ease of exploitation means attacks can be automated and widespread. The vulnerability also undermines trust in the application infrastructure and can have regulatory and compliance consequences if sensitive user data is exposed or altered.

Organizations should immediately upgrade parse-dashboard to version 9.0.0-alpha.8 or later, which includes authentication, CSRF validation, and per-app authorization middleware to secure the AI Agent API endpoint. If upgrading is not immediately feasible, administrators should remove or comment out the agent configuration block from their parse-dashboard configuration to disable the vulnerable feature. Additionally, review and rotate master keys and read-only master keys to prevent misuse. Implement network-level protections such as firewall rules to restrict access to the dashboard interface to trusted IP addresses only. Monitor logs for unusual API activity targeting the `/apps/:appId/agent` endpoint. Conduct security audits to ensure no unauthorized access occurred prior to patching. Finally, educate developers and administrators about the risks of enabling optional features without proper security controls.