CVE-2026-49229
published 2026-07-07CVE-2026-49229: Actual is a local-first personal finance app. Prior to 26.6.0, in OpenID multi-user mode, disabling a user only blocks future OpenID login for that identity…
PriorityP349high8.3CVSS 3.1
AVNACLPRLUINSUCHIHAL
EPSS
0.44%
35.8th percentile
Actual is a local-first personal finance app. Prior to 26.6.0, in OpenID multi-user mode, disabling a user only blocks future OpenID login for that identity, while existing Actual session tokens for the disabled user remain valid. The shared session validation path accepts any existing token row that has not expired without checking whether the associated user is still enabled, allowing a disabled user to continue calling authenticated server endpoints. This issue is fixed in version 26.6.0.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| actual-app | sync-server | >= 0 < 26.6.0 | 26.6.0 |
| actualbudget | actual | < 26.6.0 | 26.6.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
actualbudget Actual up to 26.5.x OpenID multi-user mode improper authentication
vuldb·2026-07-08·CVSS 8.3
CVE-2026-49229 [HIGH] actualbudget Actual up to 26.5.x OpenID multi-user mode improper authentication
A vulnerability was found in actualbudget Actual up to 26.5.x. It has been classified as critical. Affected by this vulnerability is an unknown functionality of the component OpenID multi-user mode. This manipulation causes improper authentication.
This vulnerability is tracked as CVE-2026-49229. The attack is possible to be carried out remotely. No exploit exists.
GHSA
@actual-app/sync-server: Disabled OpenID users keep access through existing session tokens
ghsa·2026-06-22
CVE-2026-49229 [HIGH] CWE-613 @actual-app/sync-server: Disabled OpenID users keep access through existing session tokens
@actual-app/sync-server: Disabled OpenID users keep access through existing session tokens
### Summary
In OpenID multi-user mode, disabling a user only blocks future OpenID login for that identity. Existing Actual session tokens for the disabled user remain valid, so the user can continue calling authenticated server endpoints after an administrator has disabled the account.
### Details
The disabled-user check is present during OpenID login finalization. Existing users are only accepted when the matching row has `enabled = 1`, and a disabled row causes the OpenID grant to fail before a new session token is created.
```ts
// packages/sync-server/src/accounts/openid.ts:284-291
const { id: userIdFromDb, display_name: displayName } =
accountDb.first(
'SELECT id, display_name FROM users WH
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/actualbudget/actual/commit/c8cb8a223a4faf1c2e1dcb0795a79a93f7b19e80https://github.com/actualbudget/actual/releases/tag/v26.6.0https://github.com/actualbudget/actual/security/advisories/GHSA-cq9c-6w48-qmfghttps://github.com/actualbudget/actual/security/advisories/GHSA-cq9c-6w48-qmfg
2026-07-07
Published