CVE-2026-46485 — Dash: Users can write to config despire permissions (OIDC tested)
Dashy is a self-hostable personal dashboard. Prior to 4.0.8, Dashy deployments using OIDC can allow unauthenticated users or non-admin authenticated users to write changes to th…
Published: 2026-07-15 · CVSS: 8.2 · CVSS 3.1
Dashy is a self-hostable personal dashboard. Prior to 4.0.8, Dashy deployments using OIDC can allow unauthenticated users or non-admin authenticated users to write changes to the main config.yaml through the config-saving functionality despite configured permissions, allowing unauthorized modification of dashboard configuration and potential service disruption. This issue is fixed in version 4.0.8.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7