CVE-2026-50007
Received Received - Intake

Missing Authorization in Actual Finance App

Publication date: 2026-07-07

Last updated on: 2026-07-07

Assigner: GitHub, Inc.

Description
Actual is an open-source personal finance application. Prior to 26.7.0, a missing authorization issue allows a shared user with user_access on a budget file to perform owner-only file management actions. A non-owner shared user can call file-management endpoints intended for higher-privilege users, including /delete-user-file, /reset-user-file, and /user-create-key, because requireFileAccess treats ordinary shared access as sufficient for file-management operations that should be restricted to the file owner or an administrator. This issue is fixed in version 26.7.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-07
Last Modified
2026-07-07
Generated
2026-07-08
AI Q&A
2026-07-08
EPSS Evaluated
N/A
NVD
CVE-2026-50007

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
actual actual 26.7.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in the Actual personal finance application prior to version 26.7.0. It is caused by a missing authorization check that allows a shared user with user_access on a budget file to perform actions that should be restricted to the file owner or an administrator.

Specifically, a non-owner shared user can call file-management endpoints such as /delete-user-file, /reset-user-file, and /user-create-key. This happens because the system treats ordinary shared access as sufficient for these sensitive file-management operations, which should require higher privileges.

The issue was fixed in version 26.7.0.

Impact Analysis

This vulnerability can impact you by allowing shared users who should have limited access to perform critical file management actions that are intended only for the file owner or administrators.

  • Unauthorized deletion of user files.
  • Resetting user files without proper permission.
  • Creating user keys without authorization.

Such unauthorized actions can lead to data loss, unauthorized access, or compromise of the integrity of your financial data.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade the Actual personal finance application to version 26.7.0 or later, where the missing authorization issue has been fixed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-50007. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart