Actual is a local‑first personal finance app. Prior to 26.6.0, in OpenID multi‑user mode, disabling a user only blocks future OpenID login for that identity, while existing Actual session tokens for the disabled user remain valid. The shared session validation path accepts any existing token row that has not expired without checking whether the associated user is still enabled, allowing a disabled user to continue calling authenticated server endpoints. This issue is fixed in version 26.6.0.

All releases of the Actual personal‑finance application prior to version 26.6.0 are affected when OpenID multi‑user mode is enabled. Only users who have previously obtained a session token retain access until the token expires. The product in question is Actual, the local‑first personal‑finance app from Actual Budget.

The CVSS score of 8.3 indicates high severity, and the EPSS score is less than 1 percent, with no listing in the KEV catalog, suggesting no publicly known exploits at present. The attack path is straightforward: an attacker possessing a valid token—such as the disabled user themselves or a malicious actor—can use it to access authenticated endpoints. Manual revocation of tokens is an inferred temporary mitigative measure, but the only fully effective remedy is applying the patch by upgrading to v26.6.0.