# CVE-2026-46700: Actual sync-server improper authorization in secrets API

Source: https://junglewise.ai/threats/cve-2026-46700-actual-sync-server-improper-authorization-in-secrets-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-07. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-46700 · Severity: medium · CVSS 4.3 · Published 2026-07-07

Actual's sync-server financial app is missing an authorization check on an endpoint that allows non-admin users to enumerate which bank-sync integrations (GoCardless, SimpleFIN, Pluggy AI) have been configured. While the actual secret values are not exposed, this reveals the deployment's financial integration setup to unauthorized users, enabling reconnaissance for follow-on attacks like phishing or exploitation of those integrations.

Technologies: [Actual Budget Sync Server](https://junglewise.ai/threats/technologies/sync-server), [@actual-app/sync-server (npm)](https://junglewise.ai/threats/technologies/actual-app-sync-server). Vendors: [Actual Budget](https://junglewise.ai/threats/vendors/actual-budget), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-46700 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-46700 being exploited in the wild.

**How severe is CVE-2026-46700?** Medium severity, with a CVSS score of 4.3, published 7 July 2026.

**Which products and versions are affected?** Actual Budget Sync Server < 26.6.0; @actual-app/sync-server (npm) < 26.6.0, SEMVER:introduced=0,fixed=26.6.0.

**Is there a fix for CVE-2026-46700?** Yes. @actual-app/sync-server (npm): upgrade to 26.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-46700 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-46700?** Check whether you run Actual Budget Sync Server or @actual-app/sync-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @actual-app/sync-server (npm): upgrade to 26.6.0 or later

  ```sh
  npm install @actual-app/sync-server@26.6.0
  ```


## Technical details

The GET /secret/:name endpoint in @actual-app/sync-server (app-secrets.js:53) checks only for a valid session but lacks the admin authorization check present in its sibling POST /secret/ handler. The vulnerability exists in OpenID multi-user deployments where non-admin authenticated users can probe secret names and distinguish 204 (configured) from 404 (missing) responses, thereby enumerating which admin-managed bank-sync integrations are active. The vulnerable secret names include gocardless_secretId, gocardless_secretKey, simplefin_token, simplefin_accessKey, pluggyai_clientId, pluggyai_clientSecret, and pluggyai_itemIds. Attack requires valid authentication as a non-admin user in OpenID mode (either auto-created or admin-provisioned). The fix is to mirror the POST handler's admin check on the GET handler, rejecting non-admin requests with a 403 error. Patch version 26.6.0 is available.

## Affected products

- Actual @actual-app/sync-server <= 26.5.2

## Identifiers

- CVE-2026-46700
- GHSA-3f62-qv96-4p78

## Timeline

- 2026-06-22: disclosed
- 2026-06-22: patched: patch available in version 26.6.0

## References

- [https://github.com/actualbudget/actual/security/advisories/GHSA-3f62-qv96-4p78](https://github.com/actualbudget/actual/security/advisories/GHSA-3f62-qv96-4p78)
- [https://github.com/actualbudget/actual](https://github.com/actualbudget/actual)

## Related threats

- [Actual Sync Server CORS proxy GitHub allowlist bypass](https://junglewise.ai/threats/cve-2026-57449-actual-is-a-local-first-personal-finance-tool-prior-to-26-7-0)
- [Actual Budget insufficient session expiration for disabled OpenID users](https://junglewise.ai/threats/cve-2026-49229-actual-budget-insufficient-session-expiration-for-disabled-openid)
- [Actual Budget sync-server information disclosure in OpenID config](https://junglewise.ai/threats/cve-2026-42604-actual-budget-sync-server-information-disclosure-in-openid-config)
- [Actual has Privilege Escalation via 'change-password' Endpoint on OpenID-Migrated Servers](https://junglewise.ai/threats/cve-2026-33318-actual-has-privilege-escalation-via-change-password-endpoint-on)
- [Actual Sync Server authenticated path traversal in file upload](https://junglewise.ai/threats/cve-2026-3089-actual-budget-actual-sync-server-path-traversal-in-file-upload)