CVE-2026-46700 Details
Description
Actual is a local-first personal finance tool. Prior to 26.6.0, the GET /secret/:name endpoint in @actual-app/sync-server checks only that the caller has a valid session and does not verify the caller is an admin, while the sibling POST /secret/ handler enforces an admin check in OpenID mode. Any authenticated non-admin BASIC user in OpenID multi-user deployments can probe the secrets store and learn which admin-managed bank-sync integrations have been configured, including simplefin_accessKey, pluggyai_clientSecret, pluggyai_itemIds, and the gocardless secrets. This issue is fixed in version 26.6.0.
A vulnerability exists in the Actual personal finance tool, specifically in the sync server component, prior to version 26.6.0. The issue arises in the GET /secret/:name endpoint, which only verifies that the caller has a valid session without checking for admin privileges. This creates an authorization gap, as the corresponding POST /secret/ endpoint does require admin approval in OpenID mode. As a result, authenticated non-admin BASIC users in OpenID multi-user deployments can probe the secrets store to identify which admin-managed bank-sync integrations are active. This includes access to certain integration credentials that are otherwise hidden from non-admin users.
Users can update to Actual version 26.6.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 7, 2026CISA-ADP
Assessed Jul 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/actualbudget/actual/security/advisories/GHSA-3f62-qv96-4p78 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/actualbudget/actual/commit/3494f78c9459ed9c412e28b500b675ba5eb72d4e | [email protected] | Source CodeVendor |
| https://github.com/actualbudget/actual/pull/7862 | [email protected] | Issue TrackingVendor |
| https://github.com/actualbudget/actual/releases/tag/v26.6.0 | [email protected] | Release NotesVendor |
| https://github.com/actualbudget/actual/security/advisories/GHSA-3f62-qv96-4p78 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-285 | Improper Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Actual | <= 26.5.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 8, 2026 | CVE Modified | CISA-ADP |
| Jul 7, 2026 | New CVE Received | [email protected] |