CVE-2026-46485
8.2
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
Summary
Dashy is a self-hostable personal dashboard. Prior to 4.0.8, Dashy deployments using OIDC can allow unauthenticated users or non-admin authenticated users to write changes to the main config.yaml through the config-saving functionality despite configured permissions, allowing unauthorized modification of dashboard configuration and potential service disruption. This issue is fixed in version 4.0.8.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| lissy93 | dashy | < 4.0.8 | affected |
Weaknesses
- CWE-15: CWE-15: External Control of System or Configuration Setting
- CWE-284: CWE-284: Improper Access Control
- CWE-287: CWE-287: Improper Authentication
- CWE-602: CWE-602: Client-Side Enforcement of Server-Side Security
References
- https://github.com/lissy93/dashy/security/advisories/GHSA-vjj9-fmvr-6h3p
- https://github.com/lissy93/dashy/releases/tag/4.0.8
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.