CVE-2026-46700

Name of the Vulnerable Software and Affected Versions @actual-app/sync-server versions prior to 26.6.0

Description An authorization asymmetry exists in the @actual-app/sync-server component of Actual. In OpenID multi-user deployments, the GET /secret/:name endpoint only verifies that a user has a valid session but fails to verify if the user has administrative privileges. In contrast, the sibling POST /secret/ handler correctly enforces an admin check. This allows any authenticated non-admin (BASIC) user to probe the secrets store by observing the HTTP response codes (204 for configured, 404 for missing). Consequently, an attacker can enumerate which admin-managed bank-sync integrations are configured, including simplefin accessKey, pluggyai clientSecret, pluggyai itemIds, and gocardless * secrets. This disclosure is limited to the existence of the secrets and does not reveal their actual values.

Recommendations Update @actual-app/sync-server to version 26.6.0.