Is CVE-2026-46700 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-46700 being exploited in the wild.

How severe is CVE-2026-46700?

Medium severity, with a CVSS score of 4.3, published 7 July 2026.

Which products and versions are affected?

Actual Budget Sync Server < 26.6.0; @actual-app/sync-server (npm) < 26.6.0, SEMVER:introduced=0,fixed=26.6.0.

Is there a fix for CVE-2026-46700?

Yes. @actual-app/sync-server (npm): upgrade to 26.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-46700 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-46700?

Check whether you run Actual Budget Sync Server or @actual-app/sync-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-46700: Actual sync-server improper authorization in secrets API

Q: Is there a fix for CVE-2026-46700?

Yes. @actual-app/sync-server (npm): upgrade to 26.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-46700 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-46700?

Check whether you run Actual Budget Sync Server or @actual-app/sync-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-46700 · Severity: medium · CVSS 4.3 · Published 2026-07-07

Actual's sync-server financial app is missing an authorization check on an endpoint that allows non-admin users to enumerate which bank-sync integrations (GoCardless, SimpleFIN, Pluggy AI) have been configured. While the actual secret values are not exposed, this reveals the deployment's financial integration setup to unauthorized users, enabling reconnaissance for follow-on attacks like phishing or exploitation of those integrations.

Technologies: Actual Budget Sync Server, @actual-app/sync-server (npm). Vendors: Actual Budget, npm.

Quick answers

Is CVE-2026-46700 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-46700 being exploited in the wild.
How severe is CVE-2026-46700?: Medium severity, with a CVSS score of 4.3, published 7 July 2026.
Which products and versions are affected?: Actual Budget Sync Server < 26.6.0; @actual-app/sync-server (npm) < 26.6.0, SEMVER:introduced=0,fixed=26.6.0.
Is there a fix for CVE-2026-46700?: Yes. @actual-app/sync-server (npm): upgrade to 26.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-46700 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-46700?: Check whether you run Actual Budget Sync Server or @actual-app/sync-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@actual-app/sync-server (npm): upgrade to 26.6.0 or later
```
npm install @actual-app/sync-server@26.6.0
```

Technical details

The GET /secret/:name endpoint in @actual-app/sync-server (app-secrets.js:53) checks only for a valid session but lacks the admin authorization check present in its sibling POST /secret/ handler. The vulnerability exists in OpenID multi-user deployments where non-admin authenticated users can probe secret names and distinguish 204 (configured) from 404 (missing) responses, thereby enumerating which admin-managed bank-sync integrations are active. The vulnerable secret names include gocardless_secretId, gocardless_secretKey, simplefin_token, simplefin_accessKey, pluggyai_clientId, pluggyai_clientSecret, and pluggyai_itemIds. Attack requires valid authentication as a non-admin user in OpenID mode (either auto-created or admin-provisioned). The fix is to mirror the POST handler's admin check on the GET handler, rejecting non-admin requests with a 403 error. Patch version 26.6.0 is available.

Affected products

Actual @actual-app/sync-server <= 26.5.2

Identifiers

CVE-2026-46700
GHSA-3f62-qv96-4p78

Timeline

2026-06-22: disclosed
2026-06-22: patched: patch available in version 26.6.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.