CVE-2026-46700: Actual Sync-Server Unauthorized Secret Enumeration (CVSS 4.3)

Technical summary

The vulnerability exists in the GET /secret/:name endpoint of @actual-app/sync-server. In OpenID mode with multiple users, the endpoint performs session validation but lacks role-based access control enforcement. Contrast this with the POST /secret/ handler, which correctly implements an admin-only check. An authenticated non-admin user with BASIC authentication credentials can send GET requests to enumerate secrets and retrieve metadata about configured integrations (SimpleFin access keys, Pluggy client secrets, Pluggy item IDs, and GoCardless credentials). The exposure is classified as CWE-285 (Improper Authorization). The fix in 26.6.0 presumably adds authorization checks to the GET endpoint to match the POST handler's enforcement.

Business impact

This vulnerability allows internal non-admin users or attackers with valid non-admin credentials to map the organization's third-party financial integrations, an operational and competitive intelligence leak. While secrets themselves are not directly exposed via this endpoint, the disclosure that a bank (e.g., GoCardless, SimpleFin) has been integrated enables targeted follow-up attacks. For personal-finance self-hosted deployments, this is a moderate concern; for organizations managing multiple tenant accounts or shared instances, the risk scales with the number of configured integrations and the sensitivity of integration choices.

Affected systems

Actual @actual-app/sync-server versions prior to 26.6.0 running in OpenID mode with multi-user deployments are affected. Single-user instances or deployments not using OpenID authentication are not vulnerable, as the flaw depends on the presence of both admin and non-admin authenticated users. The vulnerability does not affect the GET /secret/:name endpoint in non-OpenID configurations or other Actual components.

Exploitability

Exploitability is straightforward for anyone with valid non-admin credentials. No special tools, social engineering, or network positioning beyond normal user access is required. An attacker can craft simple HTTP GET requests to probe secrets by name. The attack is unauthenticated-user-agnostic if the attacker can obtain any valid non-admin login. Detection by defenders is minimal (legitimate users may query the same endpoint), making this a stealthy reconnaissance technique. The CVSS score of 4.3 (MEDIUM) reflects low privilege requirements, network accessibility, and limited confidentiality impact.

Remediation

Upgrade to Actual version 26.6.0 or later. Organizations on earlier versions should prioritize this patch if they operate multi-user OpenID deployments with sensitive integrations. As an interim control, network-level access restrictions (e.g., IP whitelisting or WAF rules blocking GET requests to /secret/* from non-admin source IPs) may reduce risk, but are not a substitute for the patch. Review audit logs for unauthorized secret enumeration queries prior to patching.

Patch guidance

Verify that your Actual deployment is running version 26.6.0 or later by checking the sync-server package version in package.json or the application version endpoint. If pinned to an earlier version, update the @actual-app/sync-server dependency to 26.6.0+ and redeploy. Test in a staging environment first to confirm the GET /secret/:name endpoint now enforces admin authorization. No database migrations or additional configuration changes are expected based on the described fix.

Detection guidance

Monitor HTTP request logs for GET requests to /secret/:* endpoints originating from users confirmed to be non-admin. Most audit-aware deployments should log the username and session principal making each request. Look for patterns of sequential or brute-forced secret name queries (e.g., iterating over known integration names like 'simplefin_accessKey', 'gocardless_secretKey'). Enable API logging and alerting on this endpoint if not already in place. Check for any GET requests to /secret/* by non-privileged accounts between the vulnerability disclosure date (2026-07-07) and your deployment date.

Why prioritize this

This vulnerability is moderate-priority for multi-user OpenID Actual deployments. The fix is simple (upgrade to 26.6.0), the impact is information disclosure rather than data exfiltration, and the attack surface is limited to users who already have valid credentials. However, if your organization uses multiple external bank integrations or considers integration choices confidential, prioritize patching within 30 days. Single-user or non-OpenID instances can defer this update.

Risk score, explained

The CVSS 3.1 score of 4.3 (MEDIUM, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) reflects: network accessibility (AV:N), low attack complexity (no special tools), a requirement for low-privilege authenticated access (PR:L), no user interaction (UI:N), scoped to the Actual instance only (S:U), low confidentiality impact limited to metadata disclosure (C:L), no integrity or availability impact (I:N, A:N). The score appropriately reflects the reconnaissance nature of the flaw without catastrophic organizational risk.

Frequently asked questions