CVE-2026-46485

Katalog CVE

CVSS 8.2 · High EPSS 0,42%

Kerentanan External Control of System or Configuration Setting. Skor CVSS 3.1 8.2 (High) menurut github.com.

Deskripsi (NVD)

Dashy is a self-hostable personal dashboard. Prior to 4.0.8, Dashy deployments using OIDC can allow unauthenticated users or non-admin authenticated users to write changes to the main config.yaml through the config-saving functionality despite configured permissions, allowing unauthorized modification of dashboard configuration and potential service disruption. This issue is fixed in version 4.0.8.

Rincian

Terbit di NVD

15 Juli 2026

Terakhir diubah

20 Juli 2026

Status NVD

Deferred

CVSS 3.1

8.2 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-15: External Control of System or Configuration Setting
CWE-284: Improper Access Control
CWE-287: Improper Authentication
CWE-602: Client-Side Enforcement of Server-Side Security

EPSS (30 hari)

0,42% peluang dieksploitasi; lebih tinggi dari 34,5% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/lissy93/dashy/releases/tag/4.0.8
• https://github.com/lissy93/dashy/security/advisories/GHSA-vjj9-fmvr-6h3p