CVE-2026-46485 Overview
Dashy is a self-hostable personal dashboard application used to organize services, links, and infrastructure resources. CVE-2026-46485 is a broken access control vulnerability affecting Dashy deployments configured with OpenID Connect (OIDC) authentication prior to version 4.0.8. The flaw allows unauthenticated users, or non-admin authenticated users, to write changes to the main config.yaml file through the config-saving functionality. This bypasses the configured permission model and enables unauthorized modification of dashboard configuration. The issue is resolved in Dashy version 4.0.8.
Critical Impact
Remote attackers can modify the primary Dashy configuration file without valid administrative credentials, leading to unauthorized dashboard changes and potential service disruption.
Affected Products
- Dashy versions prior to 4.0.8 using OIDC authentication
- Self-hosted Dashy deployments exposing the config-saving endpoint
- Dashy 4.0.8 contains the fix
Discovery Timeline
- 2026-07-15 - CVE CVE-2026-46485 published to NVD
- 2026-07-15 - Last updated in NVD database
Technical Details for CVE-2026-46485
Vulnerability Analysis
CVE-2026-46485 is a broken access control weakness classified under [CWE-15] (External Control of System or Configuration Setting). Dashy exposes a configuration-saving endpoint that writes changes to config.yaml, the file that defines dashboard layout, sections, items, authentication settings, and integrations. In deployments using OIDC, the server-side authorization check on this endpoint fails to properly enforce the configured permission model. As a result, callers without valid administrative context can invoke the save operation and overwrite server-side configuration.
Attackers can modify sections, items, and integration settings in config.yaml, altering how the dashboard renders and behaves for legitimate users. Because config.yaml also drives authentication and access options in Dashy, hostile edits can degrade availability and disrupt normal operation of the deployment.
Root Cause
The root cause is missing or incorrect authorization enforcement on the config-write path when OIDC is the configured identity provider. Permission decisions rely on state that unauthenticated or low-privileged users can satisfy, so requests reach the file-write handler despite policy configuration intended to restrict this action to administrators.
Attack Vector
Exploitation is remote, requires no authentication, and no user interaction. An attacker sends a crafted HTTP request to the Dashy config-saving endpoint of an internet-exposed instance. The server accepts the payload and persists it to config.yaml. See the GitHub Security Advisory GHSA-vjj9-fmvr-6h3p for maintainer details.
Detection Methods for CVE-2026-46485
Indicators of Compromise
- Unexpected modifications to config.yaml timestamps or contents on Dashy hosts.
- HTTP POST or PUT requests to the Dashy config-saving endpoint from unauthenticated sessions or non-admin identities.
- New, altered, or removed dashboard sections, items, or authentication entries appearing without a corresponding administrative change ticket.
Detection Strategies
- Enable file integrity monitoring on the Dashy config.yaml path and alert on any write not originating from an approved deployment pipeline.
- Review reverse proxy or web server access logs for requests targeting Dashy configuration routes from unexpected source addresses.
- Correlate identity provider logs from the configured OIDC issuer with Dashy activity to identify configuration writes lacking a corresponding admin authentication event.
Monitoring Recommendations
- Ship Dashy container and host logs to a centralized logging platform and retain configuration-write events for post-incident review.
- Track the Dashy application version across all deployments and alert when versions older than 4.0.8 remain in production.
- Baseline the contents of config.yaml under version control and diff running deployments against the trusted baseline on a schedule.
How to Mitigate CVE-2026-46485
Immediate Actions Required
- Upgrade all Dashy instances to version 4.0.8 or later, which contains the fix.
- Restrict network exposure of Dashy so the application is not reachable from untrusted networks until patched.
- Audit config.yaml for unauthorized modifications and restore from a known-good backup if tampering is detected.
Patch Information
The maintainer released the fix in Dashy 4.0.8. Refer to the GitHub Dashy Release 4.0.8 notes and the GitHub Security Advisory GHSA-vjj9-fmvr-6h3p for upgrade guidance and technical background.
Workarounds
- Place Dashy behind a reverse proxy that enforces authentication on the config-saving endpoint until the upgrade is complete.
- Mount config.yaml as a read-only file in the Dashy container to prevent runtime writes from the application process.
- Limit access to the Dashy instance using network access control lists or a VPN so only administrators can reach the service.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
