Description
Actual is a local-first personal finance tool. Prior to 26.6.0, the GET /secret/:name endpoint in @actual-app/sync-server checks only that the caller has a valid session and does not verify the caller is an admin, while the sibling POST /secret/ handler enforces an admin check in OpenID mode. Any authenticated non-admin BASIC user in OpenID multi-user deployments can probe the secrets store and learn which admin-managed bank-sync integrations have been configured, including simplefin_accessKey, pluggyai_clientSecret, pluggyai_itemIds, and the gocardless secrets. This issue is fixed in version 26.6.0.
Published: 2026-07-07
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Actual is a local-first personal finance tool. Prior to version 26.6.0, the GET /secret/:name endpoint on the @actual-app/sync-server only checked that the caller had a valid session and did not verify the caller’s admin status; the sibling POST /secret/ endpoint enforces an admin check when OpenID is used. Consequently, any authenticated non-admin BASIC user in an OpenID multi-user deployment can probe the secrets store to discover which admin-managed bank-sync integrations have been configured, such as simplefin_accessKey, pluggyai_clientSecret, pluggyai_itemIds, and gocardless secrets. The flaw is classified as CWE-285 and was fixed in version 26.6.0.

Affected Systems

The vulnerable component is the Actual Budget sync server (@actual-app/sync-server). All releases prior to version 26.6.0 are affected, including single-user and multi-user OpenID deployments that use BASIC authentication. The issue is fixed in release 26.6.0.

Risk and Exploitability

The CVSS score of 4.3 indicates moderate risk. The EPSS score is < 1%, indicating a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker only needs a valid authenticated session within the sync server; enumeration can be performed by repeatedly sending GET requests with different secret names. Once patched, the risk is eliminated, but unpatched installations remain vulnerable to disclosure of sensitive credential information.

Generated by OpenCVE AI on July 26, 2026 at 18:58 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Actual to version 26.6.0 or later to apply the authorization fix for the GET /secret/:name endpoint.
  • Reconfigure OpenID role assignments so that non-admin users do not have permission to access the /secret/ endpoint, ensuring that only admins can invoke it.
  • If immediate upgrade is not feasible, temporarily block or restrict access to the GET /secret/:name endpoint for all non-admin users by network filtering, firewall rules, or internal service configuration until the patch is applied.

Generated by OpenCVE AI on July 26, 2026 at 18:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-3f62-qv96-4p78 @actual-app/sync-server's missing authorization on GET /secret/:name allows non-admin OpenID users to enumerate admin-configured bank-sync secrets
History

Wed, 08 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 07 Jul 2026 23:45:00 +0000

Type Values Removed Values Added
First Time appeared Actualbudget
Actualbudget actual
Vendors & Products Actualbudget
Actualbudget actual

Tue, 07 Jul 2026 21:00:00 +0000

Type Values Removed Values Added
Description Actual is a local-first personal finance tool. Prior to 26.6.0, the GET /secret/:name endpoint in @actual-app/sync-server checks only that the caller has a valid session and does not verify the caller is an admin, while the sibling POST /secret/ handler enforces an admin check in OpenID mode. Any authenticated non-admin BASIC user in OpenID multi-user deployments can probe the secrets store and learn which admin-managed bank-sync integrations have been configured, including simplefin_accessKey, pluggyai_clientSecret, pluggyai_itemIds, and the gocardless secrets. This issue is fixed in version 26.6.0.
Title Actual: Missing authorization on GET /secret/:name allows non-admin OpenID users to enumerate admin-configured bank-sync secrets
Weaknesses CWE-285
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Actualbudget Actual
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-07-08T14:43:18.586Z

Reserved: 2026-05-15T23:26:58.308Z

Link: CVE-2026-46700

cve-icon Vulnrichment

Updated: 2026-07-08T14:42:35.039Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-26T19:00:02Z

Weaknesses