Actual vulnerabilities
3 known CVE vulnerabilities in Actual, translated and rated.
- CVE-2026-50179Medium
In Actual prior to 26.6.0, CSV export functions do not neutralize formula prefixes, allowing injection of malicious formulas (e.g., starting with =, +, -) into CSV files. When opened in Excel, LibreOffice Calc, or Google Sheets, these formulas execute, enabling transaction data exfiltration and manipulation of displayed values.
- CVE-2026-49229High
In Actual app in OpenID multi-user mode, disabling a user only blocks future OpenID login, but existing session tokens remain valid. The session validation does not check if the user is still enabled, allowing a disabled user to continue accessing authenticated endpoints.
- CVE-2026-50007High
In Actual up to 26.7.0, a missing authorization issue allows a shared user with user_access on a budget file to perform owner-only file management actions. A non-owner shared user can call endpoints like /delete-user-file, /reset-user-file, and /user-create-key because requireFileAccess treats ordinary shared access as sufficient for these operations.