Actual: Missing authorization on GET /secret/:name allows non-admin OpenID users to enumerate admin-configured bank-sync secrets

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-46700 · Microsoft / collected KEV context

EUVD-2026-42080

GHSA-3f62-qv96-4p78

cve-program · CVE-2026-46700

• https://github.com/actualbudget/actual/security/advisories/GHSA-3f62-qv96-4p78
• https://github.com/actualbudget/actual/pull/7862
• https://github.com/actualbudget/actual/commit/3494f78c9459ed9c412e28b500b675ba5eb72d4e
• https://github.com/actualbudget/actual/releases/tag/v26.6.0

euvd · EUVD-2026-42080

• https://github.com/actualbudget/actual/security/advisories/GHSA-3f62-qv96-4p78
• https://github.com/actualbudget/actual/pull/7862
• https://github.com/actualbudget/actual/commit/3494f78c9459ed9c412e28b500b675ba5eb72d4e
• https://github.com/actualbudget/actual/releases/tag/v26.6.0

nvd · CVE-2026-46700

• https://github.com/actualbudget/actual/commit/3494f78c9459ed9c412e28b500b675ba5eb72d4e
• https://github.com/actualbudget/actual/pull/7862
• https://github.com/actualbudget/actual/releases/tag/v26.6.0
• https://github.com/actualbudget/actual/security/advisories/GHSA-3f62-qv96-4p78

osv · GHSA-3f62-qv96-4p78

• https://github.com/actualbudget/actual/security/advisories/GHSA-3f62-qv96-4p78
• https://github.com/actualbudget/actual

No related operational record is retained in the current change model.