What is the CVSS score of CVE-2026-46485?

CVE-2026-46485 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L. EPSS exploitation probability: 0.3%.

Which versions of Dashy are affected by CVE-2026-46485?

Dashy self-hosted dashboard versions prior to 4.0.8 contain a critical authorization bypass vulnerability allowing both unauthenticated users and non-admin authenticated users to modify the central…. A patch is available.

How to fix or mitigate CVE-2026-46485?

Within 24 hours: Audit your deployed Dashy versions and if running any release prior to 4.0.8, immediately implement network-level access controls restricting unauthenticated traffic to the configuration-saving endpoint. Within 7 days: Monitor Dashy's official release channels and vendor advisories for patch availability, enable comprehensive audit logging on all configuration modification events, and document current dashboard configurations as a baseline for integrity verification. Within 30 days: Deploy any released security updates to all Dashy instances, validate configuration integrity post-deployment, and re-test OIDC permission controls to confirm authorization restrictions are properly enforced.

Dashy CVE-2026-46485

EUVD-2026-44759 HIGH

External Control of System or Configuration Setting (CWE-15)

2026-07-15 GitHub_M

Authentication Bypass Dashy Lissy93

8.2

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

vuln.today AI

8.2 HIGH

Unauthenticated network write to config (PR:N, I:H) with minor service disruption (A:L) and no data disclosure (C:N); OIDC dependency treated as a deployment precondition, not added complexity.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

Low

Lifecycle Timeline

Patch available

Jul 15, 2026 - 21:18 EUVD

Analysis Generated

Jul 15, 2026 - 18:45 vuln.today

CVE Published

Jul 15, 2026 - 18:08 cve.org

HIGH 8.2

DescriptionCVE.org

Dashy is a self-hostable personal dashboard. Prior to 4.0.8, Dashy deployments using OIDC can allow unauthenticated users or non-admin authenticated users to write changes to the main config.yaml through the config-saving functionality despite configured permissions, allowing unauthorized modification of dashboard configuration and potential service disruption. This issue is fixed in version 4.0.8.

AnalysisAI

Unauthorized configuration write in Dashy self-hosted dashboard (versions prior to 4.0.8) lets unauthenticated users or non-admin authenticated users overwrite the central config.yaml via the config-saving endpoint when the deployment uses OIDC authentication, bypassing configured permission controls. Successful abuse enables tampering with dashboard configuration and potential service disruption. No public exploit identified at time of analysis; not listed in CISA KEV.

Technical ContextAI

Dashy (CPE cpe:2.3:a:lissy93:dashy) is a Node.js-based, self-hostable personal/homelab dashboard that persists its layout and settings in a server-side config.yaml file, which can be edited through an in-app config-saving feature normally gated to administrators. The root cause maps to CWE-15 (External Control of System or Configuration Setting): when OIDC is used as the auth backend, the server-side authorization check on the config-write path fails to properly enforce the admin/permission model, so the identity or role established by OIDC is not correctly validated before the write is accepted. The Authentication Bypass tag reflects that the permission gate - not the OIDC token exchange itself - is what breaks down on the save path.

RemediationAI

Vendor-released patch: upgrade to Dashy 4.0.8, which corrects the permission enforcement on the config-saving path (release: https://github.com/lissy93/dashy/releases/tag/4.0.8; advisory: https://github.com/lissy93/dashy/security/advisories/GHSA-vjj9-fmvr-6h3p). If you cannot upgrade immediately, mitigate by disabling the in-app config editing / write-to-disk capability (for example run the container with a read-only config.yaml mount or set the environment so UI config saving is disabled), which prevents unauthorized writes at the cost of losing the ability to edit the dashboard from the UI. As an additional compensating control, place the config-write endpoint behind a reverse proxy that restricts POST/save requests to trusted admin source IPs or an authenticated proxy layer, accepting that this adds operational overhead and may block legitimate remote admins; re-enable normal editing after patching to 4.0.8.