CyberRota Analysis
AI-GeneratedThe vulnerability affects the GET /secret/:name endpoint in the Actual personal finance tool, which fails to enforce admin checks for authenticated non-admin users in OpenID multi-user deployments. This oversight allows such users to access sensitive information about admin-managed bank-sync integrations, potentially exposing critical secrets like access keys and client secrets. Organizations using versions prior to 26.6.0 should prioritize updating to mitigate the risk of unauthorized information disclosure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Actual is a local-first personal finance tool. Prior to 26.6.0, the GET /secret/:name endpoint in @actual-app/sync-server checks only that the caller has a valid session and does not verify the caller is an admin, while the sibling POST /secret/ handler enforces an admin check in OpenID mode. Any authenticated non-admin BASIC user in OpenID multi-user deployments can probe the secrets store and learn which admin-managed bank-sync integrations have been configured, including simplefin_accessKey, pluggyai_clientSecret, pluggyai_itemIds, and the gocardless secrets. This issue is fixed in version 26.6.0.