Executive brief
Actual's sync-server financial app is missing an authorization check on an endpoint that allows non-admin users to enumerate which bank-sync integrations (GoCardless, SimpleFIN, Pluggy AI) have been configured. While the actual secret values are not exposed, this reveals the deployment's financial integration setup to unauthorized users, enabling reconnaissance for follow-on attacks like phishing or exploitation of those integrations.
Technical details
The GET /secret/:name endpoint in @actual-app/sync-server (app-secrets.js:53) checks only for a valid session but lacks the admin authorization check present in its sibling POST /secret/ handler. The vulnerability exists in OpenID multi-user deployments where non-admin authenticated users can probe secret names and distinguish 204 (configured) from 404 (missing) responses, thereby enumerating which admin-managed bank-sync integrations are active. The vulnerable secret names include gocardless_secretId, gocardless_secretKey, simplefin_token, simplefin_accessKey, pluggyai_clientId, pluggyai_clientSecret, and pluggyai_itemIds. Attack requires valid authentication as a non-admin user in OpenID mode (either auto-created or admin-provisioned). The fix is to mirror the POST handler's admin check on the GET handler, rejecting non-admin requests with a 403 error. Patch version 26.6.0 is available.
Affected products
- Actual @actual-app/sync-server <= 26.5.2
Timeline
- 2026-06-22: disclosed
- 2026-06-22: patched: patch available in version 26.6.0