CyberRota Analysis
AI-GeneratedDashy deployments using OIDC prior to version 4.0.8 are vulnerable to unauthorized configuration changes, allowing unauthenticated users or non-admin authenticated users to modify the main config.yaml despite existing permissions. This could lead to unauthorized alterations of dashboard settings and potential service disruptions. Organizations utilizing Dashy for personal dashboards should prioritize upgrading to version 4.0.8 to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Dashy is a self-hostable personal dashboard. Prior to 4.0.8, Dashy deployments using OIDC can allow unauthenticated users or non-admin authenticated users to write changes to the main config.yaml through the config-saving functionality despite configured permissions, allowing unauthorized modification of dashboard configuration and potential service disruption. This issue is fixed in version 4.0.8.