# CVE-2026-46485: Dashy improper access control in config-manager configuration saving

Source: https://junglewise.ai/threats/cve-2026-46485-dashy-improper-access-control-in-config-manager-configuration  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-15. Updated: 2026-07-15  
License: CC BY 4.0 with a link back

CVE-2026-46485 · Severity: high · CVSS 8.2 · Published 2026-07-15

Dashy, a self-hostable personal dashboard, contains a security flaw in how it handles configuration updates. An unauthorized person can remotely overwrite the dashboard's settings without needing a password. This could allow an attacker to redirect users to malicious websites, change login settings to steal credentials, or disrupt the service entirely.

Technologies: [Lissy93 Dashy](https://junglewise.ai/threats/technologies/dashy). Vendors: [Lissy93](https://junglewise.ai/threats/vendors/lissy93).

## Quick answers

**Is CVE-2026-46485 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-46485 being exploited in the wild.

**How severe is CVE-2026-46485?** High severity, with a CVSS score of 8.2, published 15 July 2026.

**Which products and versions are affected?** Lissy93 Dashy < 4.0.8.

**Is there a fix for CVE-2026-46485?** A patch was published on 2026-05-09: Version 4.0.8 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-46485 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-46485?** Check whether you run Lissy93 Dashy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Dashy prior to version 4.0.8 fails to enforce server-side authentication and authorization on the '/config-manager/save' endpoint. While the dashboard may be configured to use OIDC for access control, the backend does not validate the requester's identity or administrative privileges before processing POST requests to save new configuration data. An unauthenticated attacker can send a specially crafted JSON payload to this endpoint to overwrite the 'config.yaml' file. This can be used to modify authentication providers (CWE-287), change service URLs for phishing, or cause a denial of service by injecting invalid configurations. The fix, introduced in version 4.0.8, implements proper server-side validation for configuration changes.

## Affected products

- lissy93 Dashy < 4.0.8

## Timeline

- 2026-05-09: patched: Version 4.0.8 released
- 2026-05-16: advisory: GitHub Security Advisory published
- 2026-07-15: disclosed: CVE published to NVD

## References

- [https://github.com/lissy93/dashy/releases/tag/4.0.8](https://github.com/lissy93/dashy/releases/tag/4.0.8)
- [https://github.com/lissy93/dashy/security/advisories/GHSA-vjj9-fmvr-6h3p](https://github.com/lissy93/dashy/security/advisories/GHSA-vjj9-fmvr-6h3p)

## Related threats

- [Lissy93 Dashy XSS in RSS Widget](https://junglewise.ai/threats/cve-2026-54443-lissy93-dashy-xss-in-rss-widget)
- [lissy93 Dashy XSS in workspace URL parameter](https://junglewise.ai/threats/cve-2026-55592-lissy93-dashy-xss-in-workspace-url-parameter)