Is CVE-2026-33318 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-33318 being exploited in the wild.

How severe is CVE-2026-33318?

High severity, with a CVSS score of 8.8, published 24 April 2026.

Which products and versions are affected?

@actual-app/sync-server (npm) < 26.4.0, SEMVER:introduced=0,fixed=26.4.0.

Is there a fix for CVE-2026-33318?

Yes. @actual-app/sync-server (npm): upgrade to 26.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-33318 attacked?

It is attacked over the network.

Am I affected by CVE-2026-33318?

Check whether you run Actualbudget Actual or @actual-app/sync-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33318: Actual has Privilege Escalation via 'change-password' Endpoint on OpenID-Migrated Servers

Q: Is there a fix for CVE-2026-33318?

Yes. @actual-app/sync-server (npm): upgrade to 26.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-33318 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2026-33318?

Check whether you run Actualbudget Actual or @actual-app/sync-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33318 · Severity: high · CVSS 8.8 · Published 2026-04-24

Actual is an open-source personal finance and budgeting application. On servers that have been migrated from password-based to OpenID authentication, any authenticated user can escalate their privileges to full administrator by changing the password for a hidden admin account and then logging in with that account, gaining complete control over user management, budget files, and server configuration.

Technologies: @actual-app/sync-server (npm). Vendors: Actualbudget, npm.

Quick answers

Is CVE-2026-33318 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-33318 being exploited in the wild.
How severe is CVE-2026-33318?: High severity, with a CVSS score of 8.8, published 24 April 2026.
Which products and versions are affected?: @actual-app/sync-server (npm) < 26.4.0, SEMVER:introduced=0,fixed=26.4.0.
Is there a fix for CVE-2026-33318?: Yes. @actual-app/sync-server (npm): upgrade to 26.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-33318 attacked?: It is attacked over the network.
Am I affected by CVE-2026-33318?: Check whether you run Actualbudget Actual or @actual-app/sync-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@actual-app/sync-server (npm): upgrade to 26.4.0 or later
```
npm install @actual-app/sync-server@26.4.0
```

Technical details

The vulnerability is a privilege escalation caused by three combined weaknesses: the POST /account/change-password endpoint lacks authorization checks and allows any authenticated session to modify the password hash; the inactive password authentication row is not deleted during migration to OpenID Connect; and the login endpoint accepts a client-supplied loginMethod parameter that bypasses server-side authentication configuration. An attacker with any valid OpenID session token (even BASIC role) can overwrite the password hash for the anonymous admin account created during multiuser migration, then authenticate as that admin by forcing the password login method. This attack requires the server to have been originally bootstrapped with password authentication before being migrated to OpenID, and does not affect servers configured exclusively with OpenID from initial setup. Patches are available in version 26.4.0 and later.

Affected products

Actual @actual-app/sync-server <=26.3.0

Identifiers

CVE-2026-33318
GHSA-prp4-2f49-fcgp

Timeline

2026-04-23: disclosed

References

https://github.com/actualbudget/actual/security/advisories/GHSA-prp4-2f49-fcgp

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.