Read the docs
TI-2026-36430 Aliases CVE-2026-49229GHSA-cq9c-6w48-qmfg

Actual: Disabled OpenID users keep access through existing session tokens

Priority HIGH 71CWE-613Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-613.

Summary

Actual is a local-first personal finance app. Prior to 26.6.0, in OpenID multi-user mode, disabling a user only blocks future OpenID login for that identity, while existing Actual session tokens for the disabled user remain valid. The shared session validation path accepts any existing token row that has not expired without checking whether the associated user is still enabled, allowing a disabled user to continue calling authenticated server endpoints. This issue is fixed in version 26.6.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0032 25th percentileScored 2026-11-07
Fix Fixed actual (actualbudget): 26.6.0@actual-app/sync-server (npm): 26.6.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
actualbudgetactualbefore 26.6.026.6.0Patch availableCNA
—@actual-app/sync-server (npm)before 26.6.026.6.0Patch availableGHSA-cq9c-6w48-qmfg
  • actual Vendoractualbudget Affected before 26.6.0 Fixed in 26.6.0 Patch available CNA
  • @actual-app/sync-server (npm) Vendor— Affected before 26.6.0 Fixed in 26.6.0 Patch available GHSA-cq9c-6w48-qmfg

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:actualbudget:actual:*:*:*:*:*:*:*:*——actualbudget
  • cpe:2.3:a:actualbudget:actual:*:*:*:*:*:*:*:* Versions — — ·actualbudget

Remediation

  • Fix · CNA actual (actualbudget) Fixed in 26.6.0
  • Fix · GHSA-cq9c-6w48-qmfg @actual-app/sync-server (npm) Fixed in 26.6.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-49229
  2. 2026-10-03 Alias added: GHSA-cq9c-6w48-qmfg

References

Other 4

  • TI-2026-21972 ActualBudget server is Missing Authentication for SimpleFIN and Pluggy AI bank sync endpoints CVSS 4.0CRITICAL 9.2
  • TI-2026-25729 Actual has Privilege Escalation via 'change-password' Endpoint on OpenID-Migrated Servers CVSS 3.1HIGH 8.8
  • TI-2026-36833 Actual: Shared users can perform owner-only file management actions CVSS 4.0HIGH 7.2
  • TI-2026-22020 ActualBudget missing authorization in sync endpoints allows cross-user budget file access in multi-user mode CVSS 4.0MEDIUM 5.7
  • TI-2026-41382 Information disclosure in actualbudget actual CVSS 4.0HIGH 7.1
  • TI-2026-02669 Actual Sync Server 26.2.1 - Authenticated Path Traversal CVSS 4.0MEDIUM 5.3
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences