CVE-2026-46485
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
Dashy before version 4.0.8 contains a vulnerability that allows unauthenticated users or non-admin authenticated users to write changes to the main config.yaml file through the config-saving functionality, despite configured permissions. This enables unauthorized modification of dashboard configuration and potential service disruption.
Risk Assessment
The risk includes unauthorized modification of dashboard configuration, potentially leading to service disruption, data leakage, or further privilege escalation in environments where Dashy is deployed with OIDC.
Recommendation
Immediately upgrade Dashy to version 4.0.8 or later, which includes a fix for this vulnerability.
Other vulnerabilities in Dashy
See all- CVE-2026-54443Medium
In Dashy versions 1.9.4 through 3.2.0, the RSS widget does not sanitize RSS item link values before rendering them as href attributes in anchors. This allows an attacker-controlled feed to provide a javascript: URI that executes when clicked in the Dashy origin.
- CVE-2026-55592Low
A vulnerability in Dashy before version 4.3.7 allows JavaScript execution in the application's origin context by passing a malicious URL in the 'url' parameter of the workspace view. An attacker can exploit this to steal browser data, manipulate the DOM, or send requests on behalf of the victim.
Original NVD description (English source)
Dashy is a self-hostable personal dashboard. Prior to 4.0.8, Dashy deployments using OIDC can allow unauthenticated users or non-admin authenticated users to write changes to the main config.yaml through the config-saving functionality despite configured permissions, allowing unauthorized modification of dashboard configuration and potential service disruption. This issue is fixed in version 4.0.8.