CVE-2026-49229 Details
Description
Actual is a local-first personal finance app. Prior to 26.6.0, in OpenID multi-user mode, disabling a user only blocks future OpenID login for that identity, while existing Actual session tokens for the disabled user remain valid. The shared session validation path accepts any existing token row that has not expired without checking whether the associated user is still enabled, allowing a disabled user to continue calling authenticated server endpoints. This issue is fixed in version 26.6.0.
A vulnerability exists in the Actual personal finance app, specifically in OpenID multi-user mode, prior to version 26.6.0. When a user is disabled, only future OpenID logins are blocked, while existing session tokens remain valid. This allows disabled users to access authenticated server endpoints, bypassing the intended access controls. The issue arises because the session validation process does not check if a user is enabled, leading to unauthorized access for disabled users.
Users can update to Actual version 26.6.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 7, 2026CISA-ADP
Assessed Jul 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/actualbudget/actual/security/advisories/GHSA-cq9c-6w48-qmfg | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/actualbudget/actual/commit/c8cb8a223a4faf1c2e1dcb0795a79a93f7b19e80 | [email protected] | Source CodeVendor |
| https://github.com/actualbudget/actual/releases/tag/v26.6.0 | [email protected] | Release NotesVendor |
| https://github.com/actualbudget/actual/security/advisories/GHSA-cq9c-6w48-qmfg | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-613 | Insufficient Session Expiration | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Actual | <= 26.5.2 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 9, 2026 | CVE Modified | CISA-ADP |
| Jul 9, 2026 | CVE Modified | CISA-ADP |
| Jul 8, 2026 | CVE Modified | CISA-ADP |
| Jul 7, 2026 | New CVE Received | [email protected] |