CVE-2026-49229
High
Description
Actual is a local-first personal finance app. Prior to 26.6.0, in OpenID multi-user mode, disabling a user only blocks future OpenID login for that identity, while existing Actual session tokens for the disabled user remain valid. The shared session validation path accepts any existing token row that has not expired without checking whether the associated user is still enabled, allowing a disabled user to continue calling authenticated server endpoints. This issue is fixed in version 26.6.0.
SeverityHigh
CVSS8.3
Exploit probability—
Product@actual-app/sync-server
PublishedJul 7, 2026
First seenJul 7, 2026
Weakness typeCWE-613CWE-613
How to fix
Update
- @actual-app/sync-server26.6.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| @actual-app/sync-servernpm | v < 26.6.0 | 26.6.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.