CVE-2026-46485 is a vulnerability in lissy93's Dashy dashboard software affecting versions before 4.0.8. When using OIDC authentication, the config-saving functionality improperly allows unauthenticated or non-admin authenticated users to write changes to the main config.yaml file despite configured permissions. This external control of system or configuration settings (CWE-15) can lead to unauthorized modification of the dashboard configuration and potential service disruption. The vulnerability has a CVSS 3.1 base score of 8.2, indicating high severity, with network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and low availability impact. The issue is fixed in Dashy version 4.0.8.

Unauthorized users can modify the main configuration file of Dashy, potentially disrupting service or altering dashboard behavior without permission. This compromises the integrity of the system configuration but does not impact confidentiality. Availability impact is low but present due to possible service disruption.

Upgrade Dashy to version 4.0.8 or later, where this vulnerability is fixed. No other mitigation or temporary workaround is indicated. Patch status is confirmed fixed in 4.0.8.