# CVE-2026-49229: Actual Budget insufficient session expiration for disabled OpenID users

Source: https://junglewise.ai/threats/cve-2026-49229-actual-budget-insufficient-session-expiration-for-disabled-openid  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-07. Updated: 2026-07-07  
License: CC BY 4.0 with a link back

CVE-2026-49229 · Severity: high · CVSS 8.3 · Published 2026-07-07

Actual, a personal finance and budgeting application, contained a flaw where users who were disabled by an administrator could still access their accounts. While the system blocked new logins for disabled accounts, it failed to invalidate existing active sessions. This means a deactivated user—including a former administrator—could continue to view sensitive financial data or modify budgets indefinitely if they had an active session token.

Technologies: [Actual Budget](https://junglewise.ai/threats/technologies/actual-budget), [Actual Budget Sync Server](https://junglewise.ai/threats/technologies/sync-server), [@actual-app/sync-server (npm)](https://junglewise.ai/threats/technologies/actual-app-sync-server). Vendors: [Actual Budget](https://junglewise.ai/threats/vendors/actual-budget), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-49229 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-49229 being exploited in the wild.

**How severe is CVE-2026-49229?** High severity, with a CVSS score of 8.3, published 7 July 2026.

**Which products and versions are affected?** Actual Budget < 26.6.0; Actual Budget Sync Server <= 26.5.2; @actual-app/sync-server (npm) <= 26.5.2, SEMVER:introduced=0,fixed=26.6.0.

**Is there a fix for CVE-2026-49229?** Yes. @actual-app/sync-server (npm): upgrade to 26.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-49229 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-49229?** Check whether you run Actual Budget, Actual Budget Sync Server or @actual-app/sync-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @actual-app/sync-server (npm): upgrade to 26.6.0 or later

  ```sh
  npm install @actual-app/sync-server@26.6.0
  ```


## Technical details

A session management vulnerability exists in Actual Budget's sync-server prior to version 26.6.0. While the OpenID login flow correctly checks the 'enabled' status of a user, the 'validateSession' middleware only verified that a session token existed and had not expired. Because the default 'token_expiration' is set to 'never', disabled users could retain access indefinitely. An attacker with a pre-existing session token can continue to call authenticated endpoints, including sync operations and administrative functions if they previously held an admin role. The fix in 26.6.0 ensures the session validation path joins with the users table to verify the account is still enabled and revokes existing sessions upon user deactivation.

## Affected products

- actualbudget Actual Budget < 26.6.0

## Identifiers

- CVE-2026-49229
- GHSA-cq9c-6w48-qmfg

## Timeline

- 2026-06-01: patched: Version 26.6.0 released
- 2026-06-12: advisory: GitHub Security Advisory published
- 2026-07-07: disclosed: CVE published to NVD

## References

- [https://github.com/actualbudget/actual/commit/c8cb8a223a4faf1c2e1dcb0795a79a93f7b19e80](https://github.com/actualbudget/actual/commit/c8cb8a223a4faf1c2e1dcb0795a79a93f7b19e80)
- [https://github.com/actualbudget/actual/releases/tag/v26.6.0](https://github.com/actualbudget/actual/releases/tag/v26.6.0)
- [https://github.com/actualbudget/actual/security/advisories/GHSA-cq9c-6w48-qmfg](https://github.com/actualbudget/actual/security/advisories/GHSA-cq9c-6w48-qmfg)

## Related threats

- [Actual Sync Server CORS proxy GitHub allowlist bypass](https://junglewise.ai/threats/cve-2026-57449-actual-is-a-local-first-personal-finance-tool-prior-to-26-7-0)
- [Actual Budget CSV formula injection in transaction export](https://junglewise.ai/threats/cve-2026-50179-actual-budget-csv-formula-injection-in-transaction-export)
- [Actual Budget missing authorization in file management endpoints](https://junglewise.ai/threats/cve-2026-50007-actual-budget-missing-authorization-in-file-management-endpoints)
- [Actual sync-server improper authorization in secrets API](https://junglewise.ai/threats/cve-2026-46700-actual-sync-server-improper-authorization-in-secrets-api)
- [Actual Budget path traversal in actual-server endpoints](https://junglewise.ai/threats/cve-2026-43872-actual-budget-path-traversal-in-actual-server-endpoints)