CVE-2026-50007
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
In Actual up to 26.7.0, a missing authorization issue allows a shared user with user_access on a budget file to perform owner-only file management actions. A non-owner shared user can call endpoints like /delete-user-file, /reset-user-file, and /user-create-key because requireFileAccess treats ordinary shared access as sufficient for these operations.
Risk Assessment
The risk is that a shared user can delete or reset the budget file and create user keys, leading to data loss, service disruption, or unauthorized access to sensitive financial information.
Recommendation
Immediately update Actual to version 26.7.0 or later, which contains the fix for this authorization vulnerability.
Other vulnerabilities in Actual
See all- CVE-2026-50179Medium
In Actual prior to 26.6.0, CSV export functions do not neutralize formula prefixes, allowing injection of malicious formulas (e.g., starting with =, +, -) into CSV files. When opened in Excel, LibreOffice Calc, or Google Sheets, these formulas execute, enabling transaction data exfiltration and manipulation of displayed values.
- CVE-2026-49229High
In Actual app in OpenID multi-user mode, disabling a user only blocks future OpenID login, but existing session tokens remain valid. The session validation does not check if the user is still enabled, allowing a disabled user to continue accessing authenticated endpoints.
Original NVD description (English source)
Actual is an open-source personal finance application. Prior to 26.7.0, a missing authorization issue allows a shared user with user_access on a budget file to perform owner-only file management actions. A non-owner shared user can call file-management endpoints intended for higher-privilege users, including /delete-user-file, /reset-user-file, and /user-create-key, because requireFileAccess treats ordinary shared access as sufficient for file-management operations that should be restricted to the file owner or an administrator. This issue is fixed in version 26.7.0.