Dashy, a self‑hosted personal dashboard, had a flaw that allowed an OIDC‑based configuration‑saving feature to accept write requests from unauthenticated users or non‑admin authenticated users even when write permissions were set to restrict access. This flaw enabled attackers to overwrite the main config.yaml file, changing dashboard layout, routing, or authentication settings and potentially causing service disruption or compromising confidentiality and integrity. The vulnerability stems from improper access control (CWE‑284), weak privilege escalation (CWE‑287), insecure configuration handling (CWE‑15), and path traversal (CWE‑602). The issue is fixed in release 4.0.8.

All Dashy deployments using OIDC that run a version older than 4.0.8 are affected. The flaw exists in the Dashy release identified as lissy93:dashy. Upgrading to 4.0.8 or newer resolves the vulnerability.

The CVSS score of 8.2 classifies this as a high severity flaw. Although the EPSS indicates a low exploitation probability (<1%), the description infers that the vulnerability can be exploited over the network via the public interface and does not require local access. It is not listed in CISA’s KEV catalog. An attacker who succeeds in writing to the configuration files could cause denial of service or alter the platform’s behavior, potentially compromising confidentiality and integrity of exposed data.