CVE-2026-49229

Name of the Vulnerable Software and Affected Versions Actual versions prior to 26.6.0

Description In OpenID multi-user mode, disabling a user only prevents future OpenID logins for that identity. Existing session tokens remain valid because the shared session validation path does not check if the associated user is still enabled. This allows a disabled user to continue accessing authenticated server endpoints. The issue is particularly persistent in default deployments where the token expiration variable is set to never. A disabled user can maintain access to their own budgets, shared budgets containing sensitive financial data, or even administrative privileges if the disabled account had an admin role. The vulnerability involves the validateSession() function and affects endpoints protected by validateSessionMiddleware, such as the sync API and the /users update route via the enabled variable.

Recommendations Update Actual to version 26.6.0.