Parse Dashboard CVE-2026-27595

The decisive prerequisite is that the dashboard must have the opt-in AI agent feature enabled - specifically an agent configuration block present in the Parse Dashboard configuration; without it the endpoint does not exist and the install is not affected. When that block is present, no further conditions apply: per the CVSS vector (AV:N/AC:L/PR:N/UI:N) exploitation is remote, unauthenticated, low-complexity, and requires no user interaction against the POST /apps/:appId/agent endpoint. Limiting factors that reduce realistic exposure: the agent configuration must be deliberately enabled (non-default), the dashboard must be network-reachable by the attacker, and all affected versions are alpha pre-releases rather than stable releases.

Signals conflict and must be weighed together. The CVSS 4.0 base score of 9.9 (AV:N/AC:L/AT:N/PR:N/UI:N, VC:H/VI:H, SC:H/SI:H) reflects a network-reachable, unauthenticated, low-complexity flaw with high confidentiality and integrity impact on both the dashboard and the subsequent Parse Server system - a genuinely severe technical impact. Against that, EPSS is only 0.04% (10th percentile), there is no CISA KEV listing, and no public exploit was identified, indicating low observed/predicted exploitation activity. The reconciling factor is the opt-in nature of the agent feature: the high CVSS assumes the feature is enabled, while the low EPSS likely reflects that most installs never enable it, shrinking the exploitable population. For organizations that HAVE enabled the agent, this is a top-priority, internet-exploitable issue; for everyone else it is not applicable. Note also that affected versions are all alpha pre-releases, which further limits real-world exposure.

An attacker who can reach an internet-exposed Parse Dashboard that has the AI agent feature enabled sends an unauthenticated POST to /apps/:appId/agent and instructs the agent to read or modify records, which it executes with the Parse Server master key - bypassing all class-level and ACL restrictions. With low attack complexity and no authentication or user interaction required, the attacker can exfiltrate sensitive collections or tamper with/delete application data. No public proof-of-concept was identified at time of analysis.