CVE-2026-46485

Deferred Deferred - Pending Action

Unauthenticated Config Write in Dashy

Publication date: 2026-07-15

Last updated on: 2026-07-20

Assigner: GitHub, Inc.

Description

Dashy is a self-hostable personal dashboard. Prior to 4.0.8, Dashy deployments using OIDC can allow unauthenticated users or non-admin authenticated users to write changes to the main config.yaml through the config-saving functionality despite configured permissions, allowing unauthorized modification of dashboard configuration and potential service disruption. This issue is fixed in version 4.0.8.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-15

Last Modified

2026-07-20

Generated

2026-08-05

AI Q&A

2026-07-16

EPSS Evaluated

2026-08-03

NVD

CVE-2026-46485

EUVD

EUVD-2026-44759

Affected Vendors & Products

Vendor	Product	Version / Range
lissy93	dashy	to 4.0.8 (inc)
lissy93	dashy	to 4.0.8 (exc)
lissy93	dashy	to 3.2.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-602	The product is composed of a server that relies on the client to implement a mechanism that is intended to protect the server.
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CWE-15	One or more system settings or configuration elements can be externally controlled by a user.

Attack-Flow Graph

Executive Summary

Dashy is a self-hostable personal dashboard. Prior to version 4.0.8, Dashy deployments using OIDC authentication allowed unauthenticated users or non-admin authenticated users to write changes to the main config.yaml file through the config-saving functionality despite configured permissions. This vulnerability enables unauthorized modification of dashboard configuration and potential service disruption.

Detection Guidance

Check if your Dashy instance is running a vulnerable version (3.2.0 or earlier). Inspect network traffic for POST requests to the /config-manager/save endpoint with JSON payloads modifying config.yaml. Review server logs for unauthorized configuration changes.

Impact Analysis

An attacker can exploit this by sending a crafted POST request to the endpoint /config-manager/save with a JSON payload to overwrite the existing configuration. This allows unauthenticated attackers to modify authentication settings, redirect OIDC to a malicious identity provider for credential phishing, or replace legitimate service URLs with malicious links to target internal services.

Compliance Impact

This vulnerability could lead to unauthorized access and modification of sensitive data, potentially violating confidentiality and integrity requirements under GDPR and HIPAA. Unauthorized configuration changes may expose personal or health data to attackers, resulting in compliance breaches and regulatory penalties.

Mitigation Strategies

Upgrade Dashy to version 4.0.8 or later immediately. If upgrading is not possible, restrict access to the /config-manager/save endpoint and disable OIDC authentication temporarily until patched.

Hi! I’m here to help you understand CVE-2026-46485. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70