Executive brief
Dashy, a self-hostable personal dashboard, contains a security flaw in how it handles configuration updates. An unauthorized person can remotely overwrite the dashboard's settings without needing a password. This could allow an attacker to redirect users to malicious websites, change login settings to steal credentials, or disrupt the service entirely.
Technical details
Dashy prior to version 4.0.8 fails to enforce server-side authentication and authorization on the '/config-manager/save' endpoint. While the dashboard may be configured to use OIDC for access control, the backend does not validate the requester's identity or administrative privileges before processing POST requests to save new configuration data. An unauthenticated attacker can send a specially crafted JSON payload to this endpoint to overwrite the 'config.yaml' file. This can be used to modify authentication providers (CWE-287), change service URLs for phishing, or cause a denial of service by injecting invalid configurations. The fix, introduced in version 4.0.8, implements proper server-side validation for configuration changes.
Affected products
- lissy93 Dashy < 4.0.8
Timeline
- 2026-05-09: patched: Version 4.0.8 released
- 2026-05-16: advisory: GitHub Security Advisory published
- 2026-07-15: disclosed: CVE published to NVD