CVE-2026-46700

Received Received - Intake

Information Disclosure in Actual Finance Tool

Publication date: 2026-07-07

Last updated on: 2026-07-07

Assigner: GitHub, Inc.

Description

Actual is a local-first personal finance tool. Prior to 26.6.0, the GET /secret/:name endpoint in @actual-app/sync-server checks only that the caller has a valid session and does not verify the caller is an admin, while the sibling POST /secret/ handler enforces an admin check in OpenID mode. Any authenticated non-admin BASIC user in OpenID multi-user deployments can probe the secrets store and learn which admin-managed bank-sync integrations have been configured, including simplefin_accessKey, pluggyai_clientSecret, pluggyai_itemIds, and the gocardless secrets. This issue is fixed in version 26.6.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-07

Last Modified

2026-07-07

Generated

2026-07-08

AI Q&A

2026-07-08

EPSS Evaluated

N/A

NVD

CVE-2026-46700

Affected Vendors & Products

Vendor	Product	Version / Range
actual	actual	26.6.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-285	The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

The vulnerability exists in the Actual personal finance tool prior to version 26.6.0. Specifically, the GET /secret/:name endpoint in the @actual-app/sync-server only checks if the caller has a valid session but does not verify if the caller is an admin. This allows any authenticated non-admin BASIC user in OpenID multi-user deployments to access and probe the secrets store.

As a result, these users can discover which admin-managed bank-sync integrations have been configured, including sensitive secrets such as simplefin_accessKey, pluggyai_clientSecret, pluggyai_itemIds, and gocardless secrets.

This issue was fixed in version 26.6.0 by enforcing proper admin checks.

Impact Analysis

This vulnerability can impact you by allowing any authenticated non-admin user to access sensitive secret information related to bank-sync integrations that should only be accessible by administrators.

Exposure of these secrets could lead to unauthorized access or misuse of financial integrations, potentially compromising the security and privacy of financial data.

However, the CVSS base score of 4.3 indicates a medium severity impact, with limited scope to confidentiality and no impact on integrity or availability.

Mitigation Strategies

To mitigate this vulnerability, upgrade the Actual application to version 26.6.0 or later, where the issue is fixed.

Compliance Impact

This vulnerability allows any authenticated non-admin user in OpenID multi-user deployments to access information about admin-managed bank-sync integrations, including sensitive secrets such as access keys and client secrets.

Such unauthorized disclosure of sensitive financial integration secrets could potentially lead to non-compliance with data protection regulations like GDPR and HIPAA, which require strict controls on access to sensitive personal and financial information.

However, the provided information does not explicitly state the direct impact on compliance with these standards.

Hi! I’m here to help you understand CVE-2026-46700. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70