Executive brief
Actual, an open-source personal finance application, contains a flaw where users invited to share a budget can perform administrative actions they should not have access to. Specifically, a guest user can delete budget files, reset synchronization data, or change encryption keys belonging to the file owner. This could lead to permanent data loss or unauthorized locking of financial records by a malicious collaborator.
Technical details
A missing authorization vulnerability exists in Actual Budget prior to version 26.7.0. The application's 'requireFileAccess' middleware incorrectly treated any user with shared access as having sufficient privileges for administrative file-management operations. An authenticated attacker with basic 'user_access' permissions on a shared budget can call restricted endpoints such as /delete-user-file, /reset-user-file, and /user-create-key. This allows a non-owner collaborator to delete the owner's files, reset sync states, or overwrite encryption keys. The fix introduces a stricter 'requireFileOwner' helper to enforce proper access control on these sensitive endpoints.
Affected products
- Actual Budget Actual < 26.7.0
Timeline
- 2026-05-29: patched: Fix committed to master branch
- 2026-07-07: advisory: NVD and GitHub Security Advisory published
References
- https://github.com/actualbudget/actual/commit/18a8dc03c48eeb2e8252669a80673e6a9933b5fd
- https://github.com/actualbudget/actual/commit/3b9e79ed5ee795a80bbae214d6ebb2755289d7f2
- https://github.com/actualbudget/actual/pull/7977
- https://github.com/actualbudget/actual/pull/8333
- https://github.com/actualbudget/actual/security/advisories/GHSA-23vm-ffgg-qvjr