Actual, a local‑first personal finance tool, had a missing authorization check in its sync API endpoints before version 26.2.1. The flaw is a CWE‑862 privilege escalation that allows any authenticated user in multi‑user mode to read, modify, and overwrite any other user’s budget files by supplying the file’s identifier. This results in a confidentiality breach and integrity compromise of sensitive financial information.

The vulnerability affects installations of actualbudget:actual on all platform versions prior to release 26.2.1 released in March 2026. Subsequent releases include the necessary patch to enforce proper ownership verification on the sync endpoints.

The CVSS score of 5.7 classifies the issue as moderate severity, and the EPSS score of less than 1 % indicates a low probability of exploitation at the time of assessment. The vulnerability is not listed in the CISA KEV catalog. Attackers must first authenticate to the application and possess knowledge of a target user’s budget file ID. Successful exploitation would grant direct access to that user’s data, allowing data extraction or tampering. Given the low exploitation probability and the requirement of authenticated access, the overall risk to environments already employing the latest patch remains low, but unpatched deployments remain vulnerable.