Actual is an open‑source personal‑finance application. A missing authorization flaw (CWE-862) allows a non‑owner shared user who has user_access on a budget file to call file‑management endpoints that are intended for the file owner or an administrator. Functions affected include /delete-user-file, /reset-user-file, and /user-create-key, because the requireFileAccess check mistakenly treats ordinary shared access as sufficient for these privileged operations. Exploitation can lead to deletion of the file, reset of data, or creation of credentials that grant owner‑level control, thereby compromising the integrity and confidentiality of the budget file.

All releases of Actual by actualbudget older than version 26.7.0 are impacted. The vulnerability manifests within the shared‑user mechanism of the application, affecting any user that has been granted shared user access to a budget file without being the owner. The issue is resolved in Actual version 26.7.0 and later.

The CVSS score of 7.2 indicates a high severity condition. The EPSS score is less than 1%, implying a very low probability of exploitation at present, and the vulnerability is not listed in CISA's KEV catalog. Attackers would need a valid shared‑user account with user_access on a target budget file; no additional elevated network privileges are required. The flaw is a server‑side authorization bypass, so it can be exploited remotely from any client that can access the application’s interface. Because the description does not specify any additional preconditions, it is inferred that simply possessing an authorized shared‑user session is sufficient to trigger the vulnerable endpoints.