CVE-2026-46485 Dash: Users can write to config despire permissions (OIDC tested)
Unauthenticated or non-admin users can modify the main configuration file in Dashy deployments using OIDC, leading to unauthorized changes and potential service disruption.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-46485?
CVE-2026-46485 is a high-severity missing authorization vulnerability in lissy93 dashy, published on 15 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Dashy is a self-hostable personal dashboard. Prior to 4.0.8, Dashy deployments using OIDC can allow unauthenticated users or non-admin authenticated users to write changes to the main config.yaml through the config-saving functionality despite configured permissions, allowing unauthorized modification of dashboard configuration and potential service disruption. This issue is fixed in version 4.0.8.
Which versions are affected by CVE-2026-46485?
How do I fix CVE-2026-46485?
No fix has been published for CVE-2026-46485 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-46485 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-46485 exists.
Sources
Also known as GHSA-vjj9-fmvr-6h3p.