Is CVE-2026-46485 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-46485 being exploited in the wild.

How severe is CVE-2026-46485?

High severity, with a CVSS score of 8.2, published 15 July 2026.

Is there a fix for CVE-2026-46485?

A patch was published on 2026-05-09: Version 4.0.8 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-46485 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-46485?

Check whether you run Lissy93 Dashy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-46485: Dashy improper access control in config-manager configuration saving

CVE-2026-46485 · Severity: high · CVSS 8.2 · Published 2026-07-15

Dashy, a self-hostable personal dashboard, contains a security flaw in how it handles configuration updates. An unauthorized person can remotely overwrite the dashboard's settings without needing a password. This could allow an attacker to redirect users to malicious websites, change login settings to steal credentials, or disrupt the service entirely.

Technologies: Lissy93 Dashy. Vendors: Lissy93.

Quick answers

Is CVE-2026-46485 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-46485 being exploited in the wild.
How severe is CVE-2026-46485?: High severity, with a CVSS score of 8.2, published 15 July 2026.
Which products and versions are affected?: Lissy93 Dashy < 4.0.8.
Is there a fix for CVE-2026-46485?: A patch was published on 2026-05-09: Version 4.0.8 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-46485 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-46485?: Check whether you run Lissy93 Dashy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Dashy prior to version 4.0.8 fails to enforce server-side authentication and authorization on the '/config-manager/save' endpoint. While the dashboard may be configured to use OIDC for access control, the backend does not validate the requester's identity or administrative privileges before processing POST requests to save new configuration data. An unauthenticated attacker can send a specially crafted JSON payload to this endpoint to overwrite the 'config.yaml' file. This can be used to modify authentication providers (CWE-287), change service URLs for phishing, or cause a denial of service by injecting invalid configurations. The fix, introduced in version 4.0.8, implements proper server-side validation for configuration changes.

Affected products

lissy93 Dashy < 4.0.8

Timeline

2026-05-09: patched: Version 4.0.8 released
2026-05-16: advisory: GitHub Security Advisory published
2026-07-15: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.