CVE-2026-46485CWE-15CWE-284CWE-287CWE-602

Dash: Users can write to config despire permissions (OIDC tested)

High · published July 15, 2026

CVSS v3.1
8.2
EPSS
0%
Percentile
35.2
In the wild
Unconfirmed
What it is

Dashy is a self-hostable personal dashboard. Prior to 4.0.8, Dashy deployments using OIDC can allow unauthenticated users or non-admin authenticated users to write changes to the main config.yaml through the config-saving functionality despite configured permissions, allowing unauthorized modification of dashboard configuration and potential service disruption. This issue is fixed in version 4.0.8.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00420 · 35.2th percentile
Weaknesses
CWE-15 · External Control of System or Configuration Setting; CWE-284 · Improper Access Control; CWE-287 · Improper Authentication; CWE-602 · Client-Side Enforcement of Server-Side Security
Published
2026-07-15T18:08Z
EPSS history
Timeline
  • 15 JUL 18:08Z
    Dash: Users can write to config despire permissions (OIDC tested)
    cvelistv5