Actual is a local‑first personal finance tool that uses a sync server. Prior to version 26.6.0, a flaw in the GET /secret/:name endpoint caused it to verify only that a caller had a valid session, without checking that the caller was an administrator. This lack of authorization enforcement allowed any authenticated non‑admin BASIC user in an OpenID multi‑user deployment to probe the secrets store and discover which bank‑sync integrations were configured, exposing credentials such as simplefin_accessKey, pluggyai_clientSecret, pluggyai_itemIds, and Gocardless secrets. The vulnerability is classified as a CWE‑285 authorization bypass and results in accidental disclosure of sensitive credential information.

The vulnerable component is the Actual Budget sync server (@actual-app/sync-server). All releases before version 26.6.0 contain the flaw. The issue applies to OpenID multi‑user deployments that use BASIC authentication; non‑admin users in those environments can trigger the enumeration.

The CVSS score of 4.3 indicates moderate risk, while the EPSS score is under 1%, suggesting a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires only a valid authenticated session within the sync server; repeated GET requests with different secret names allow enumeration. Once the patch is applied, the risk of disclosing credential data is eliminated.