{"id":"EUVD-2026-42080","enisaUuid":"ddd3c646-2680-3bb7-884f-27a9bf57f946","description":"Actual is a local-first personal finance tool. Prior to 26.6.0, the GET /secret/:name endpoint in @actual-app/sync-server checks only that the caller has a valid session and does not verify the caller is an admin, while the sibling POST /secret/ handler enforces an admin check in OpenID mode. Any authenticated non-admin BASIC user in OpenID multi-user deployments can probe the secrets store and learn which admin-managed bank-sync integrations have been configured, including simplefin_accessKey, pluggyai_clientSecret, pluggyai_itemIds, and the gocardless secrets. This issue is fixed in version 26.6.0.","datePublished":"Jul 7, 2026, 8:56:39 PM","dateUpdated":"Jul 8, 2026, 2:43:18 PM","baseScore":4.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","references":"https://github.com/actualbudget/actual/security/advisories/GHSA-3f62-qv96-4p78\nhttps://github.com/actualbudget/actual/pull/7862\nhttps://github.com/actualbudget/actual/commit/3494f78c9459ed9c412e28b500b675ba5eb72d4e\nhttps://github.com/actualbudget/actual/releases/tag/v26.6.0\n","aliases":"CVE-2026-46700\nGHSA-3f62-qv96-4p78\n","assigner":"GitHub_M","epss":0.25,"enisaIdProduct":[{"id":"33fb97ad-b74c-325b-95cd-4075426563ad","product":{"name":"actual","vendor":{"name":"actualbudget"}},"product_version":"\u003c 26.6.0"}],"enisaIdVendor":[{"id":"b8b91872-dab9-38e1-aba4-c2b62556acb2","vendor":{"name":"actualbudget"}}],"enisaIdVulnerability":[{"id":"86aee3f8-75c2-33c4-aa23-120f111e54e7","vulnerability":{"id":"GHSA-3f62-qv96-4p78","description":"@actual-app/sync-server\u0027s missing authorization on GET /secret/:name allows non-admin OpenID users to enumerate admin-configured bank-sync secrets","datePublished":"Jun 22, 2026, 9:42:34 PM","dateUpdated":"Jun 22, 2026, 9:42:34 PM","baseScore":0.0,"references":"https://github.com/actualbudget/actual/security/advisories/GHSA-3f62-qv96-4p78\nhttps://github.com/actualbudget/actual\n","enisa_id":"EUVD-2026-42080\n","aliases":"CVE-2026-46700\nGHSA-3f62-qv96-4p78\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"9b28bee4-f3ab-3220-8cf6-967d1f90746c","vulnerability":{"id":"CVE-2026-46700","description":"Actual is a local-first personal finance tool. Prior to 26.6.0, the GET /secret/:name endpoint in @actual-app/sync-server checks only that the caller has a valid session and does not verify the caller is an admin, while the sibling POST /secret/ handler enforces an admin check in OpenID mode. Any authenticated non-admin BASIC user in OpenID multi-user deployments can probe the secrets store and learn which admin-managed bank-sync integrations have been configured, including simplefin_accessKey, pluggyai_clientSecret, pluggyai_itemIds, and the gocardless secrets. This issue is fixed in version 26.6.0.","datePublished":"Jul 7, 2026, 8:56:39 PM","dateUpdated":"Jul 8, 2026, 2:43:18 PM","status":"PUBLISHED","baseScore":4.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","references":"https://github.com/actualbudget/actual/security/advisories/GHSA-3f62-qv96-4p78\nhttps://github.com/actualbudget/actual/pull/7862\nhttps://github.com/actualbudget/actual/commit/3494f78c9459ed9c412e28b500b675ba5eb72d4e\nhttps://github.com/actualbudget/actual/releases/tag/v26.6.0\n","enisa_id":"EUVD-2026-42080\n","assigner":"GitHub_M","epss":0.25,"dataProcessed":"Nov 7, 2026, 7:22:17 AM","vulnerabilityProduct":[{"id":"e6925d19-701b-3c62-82ab-2ad85d039d15","product":{"name":"actual","vendor":{"name":"actualbudget"}},"product_version":"\u003c 26.6.0"}],"vulnerabilityVendor":[{"id":"a51f571c-3d0e-39b7-8380-590ac9e3762b","vendor":{"name":"actualbudget"}}]}}],"enisaIdAdvisory":[]}