CVE-2026-49229

8.3 Élevée

Publiée le 08/07/2026 à 00:16 · Modifiée le 09/07/2026 à 17:16 · Analyse NVD reportée · Source : security-advisories@github.com

Description

Actual is a local-first personal finance app. Prior to 26.6.0, in OpenID multi-user mode, disabling a user only blocks future OpenID login for that identity, while existing Actual session tokens for the disabled user remain valid. The shared session validation path accepts any existing token row that has not expired without checking whether the associated user is still enabled, allowing a disabled user to continue calling authenticated server endpoints. This issue is fixed in version 26.6.0.

Traduire en français

Produits concernés

actualbudget actual

Scores CVSS

Version	Score	Source	Vecteur
3.1	8.3 Élevée	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L`

Faiblesses (CWE)

CWE-613

Références

https://github.com/actualbudget/actual/commit/c8cb8a223a4faf1c2e1dcb0795a79a93f7b19e80
https://github.com/actualbudget/actual/releases/tag/v26.6.0
https://github.com/actualbudget/actual/security/advisories/GHSA-cq9c-6w48-qmfg
https://github.com/actualbudget/actual/security/advisories/GHSA-cq9c-6w48-qmfg

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories