Executive brief
Actual is an open-source personal finance and budgeting application. On servers that have been migrated from password-based to OpenID authentication, any authenticated user can escalate their privileges to full administrator by changing the password for a hidden admin account and then logging in with that account, gaining complete control over user management, budget files, and server configuration.
Technical details
The vulnerability is a privilege escalation caused by three combined weaknesses: the POST /account/change-password endpoint lacks authorization checks and allows any authenticated session to modify the password hash; the inactive password authentication row is not deleted during migration to OpenID Connect; and the login endpoint accepts a client-supplied loginMethod parameter that bypasses server-side authentication configuration. An attacker with any valid OpenID session token (even BASIC role) can overwrite the password hash for the anonymous admin account created during multiuser migration, then authenticate as that admin by forcing the password login method. This attack requires the server to have been originally bootstrapped with password authentication before being migrated to OpenID, and does not affect servers configured exclusively with OpenID from initial setup. Patches are available in version 26.4.0 and later.
Affected products
- Actual @actual-app/sync-server <=26.3.0
Timeline
- 2026-04-23: disclosed