Actual is an open‑source personal finance application. Prior to 26.7.0, a missing authorization issue (CWE‑862 Authorization Bypass) allows a shared user with user_access on a budget file to perform owner‑only file‑management actions. A non‑owner shared user can call file‑management endpoints intended for higher‑privilege users—including /delete-user-file, /reset-user-file, and /user‑create‑key—because requireFileAccess treats ordinary shared access as sufficient for file‑management operations that should be restricted to the file owner or an administrator. This issue is fixed in version 26.7.0.

This issue impacts all releases of Actual by actualbudget before version 26.7.0. It manifests in the shared‑user functionality of the open‑source personal‑finance application Actual. Users who have shared access to a budget file without owning it are at risk if the application is at any earlier version.

The CVSS score of 7.2 indicates high severity. The EPSS score is less than 1%, implying a very low probability of exploitation. The vulnerability is not listed in CISA's KEV catalog. Attackers would need a shared‑user account with user_access on a target budget file; no elevated network privileges are required. Because the flaw is a server‑side authorization bypass, exploitation can occur remotely where the user has access to the application interface.