Actual is a local‑first personal finance application that, prior to version 26.4.0, allows any authenticated user, including those with a BASIC role, to attain administrative privileges on servers transitioned from password authentication to OpenID Connect. The attacker must first overwrite an orphaned password hash via POST /account/change-password, then use a client‑supplied loginMethod to force password authentication against that hash, and finally authenticate as the anonymous admin account created during the migration. The weakest point is the missing authorization check on the /change-password endpoint; the other weaknesses are preconditions that allow the chain to succeed. If all three steps succeed the attacker can modify all data and execute any action as an admin, compromising confidentiality, integrity, and availability of the system.

The affected product is Actual from actualbudget. Versions older than 26.4.0 on servers that migrated to OpenID Connect are vulnerable. The vulnerability exists for installations that still retain orphaned password rows after migration to OpenID Connect. No specific operating system or Node.js version is indicated beyond the general dependency on Node.js for the application.

The CVSS score of 8.8 reflects a high severity impact. The EPSS score is less than 1%, indicating a very low probability of exploitation in the wild, yet the vulnerability has been documented in a public advisory and exists in deployed, unpatched systems. Because the exploitation chain requires sequential steps—overwriting a password hash, forcing a password login, and authenticating as the anonymous admin—the attack vector is likely internal or from a compromised authenticated session. The vulnerability is not listed in the CISA KEV catalog, but the high CVSS rating warrants prompt remediation The lack of an authorization check on /change-password is the root cause and allows an attacker who can reach the endpoint to obtain full administrative control if the preconditions are present.