CVE-2026-49229
HighCVSS 8.3Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
In Actual app in OpenID multi-user mode, disabling a user only blocks future OpenID login, but existing session tokens remain valid. The session validation does not check if the user is still enabled, allowing a disabled user to continue accessing authenticated endpoints.
Risk Assessment
The risk is that a disabled user can still access financial data and application features, violating security policies and access control in the organization.
Recommendation
Immediately update Actual to version 26.6.0 or later, which includes a fix for this vulnerability.
Original NVD description (English source)
Actual is a local-first personal finance app. Prior to 26.6.0, in OpenID multi-user mode, disabling a user only blocks future OpenID login for that identity, while existing Actual session tokens for the disabled user remain valid. The shared session validation path accepts any existing token row that has not expired without checking whether the associated user is still enabled, allowing a disabled user to continue calling authenticated server endpoints. This issue is fixed in version 26.6.0.