CVE-2026-46485: LISSY93 Dashy

High severity, CVSS 8.2. EPSS: 0.4% chance of exploitation in the next 30 days.

Dashy is a self-hostable personal dashboard. Prior to 4.0.8, Dashy deployments using OIDC can allow unauthenticated users or non-admin authenticated users to write changes to the main config.yaml through the config-saving functionality despite configured permissions, allowing unauthorized modification of dashboard configuration and potential service disruption. This issue is fixed in version 4.0.8.

Affected products

• LISSY93 Dashy: before 4.0.8 (fixed in 4.0.8)

Published 2026-07-15. Last modified 2026-07-20.