Which versions of Actual are affected by CVE-2026-50007?

Actual before version 26.7.0 contains a privilege escalation vulnerability allowing any shared budget user to destroy, reset, or compromise financial records through unauthorized key rotation.. A patch is available.

How to fix or mitigate CVE-2026-50007?

Within 24 hours: Identify all Actual instances running versions before 26.7.0 and audit users with budget file sharing permissions. Within 7 days: Plan deployment of Actual 26.7.0 or later and temporarily restrict non-essential shared budget file access. Within 30 days: Complete upgrade to Actual 26.7.0 or later, review file operation audit logs, and validate encryption keys.

Actual CVE-2026-50007

Q: What is the CVSS score of CVE-2026-50007?

CVE-2026-50007 has a CVSS 4.0 base score of 7.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-42078 HIGH

Missing Authorization (CWE-862)

2026-07-07 GitHub_M

Authentication Bypass Actual Actualbudget

7.2

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.2 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.1 HIGH

Network-reachable endpoint (AV:N/AC:L) callable by an authenticated low-privilege shared user (PR:L); data deletion/reset gives I:H and A:H, with no data disclosure so C:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 07, 2026 - 22:01 EUVD

Analysis Generated

Jul 07, 2026 - 21:37 vuln.today

DescriptionCVE.org

Actual is an open-source personal finance application. Prior to 26.7.0, a missing authorization issue allows a shared user with user_access on a budget file to perform owner-only file management actions. A non-owner shared user can call file-management endpoints intended for higher-privilege users, including /delete-user-file, /reset-user-file, and /user-create-key, because requireFileAccess treats ordinary shared access as sufficient for file-management operations that should be restricted to the file owner or an administrator. This issue is fixed in version 26.7.0.

AnalysisAI

Privilege escalation via broken authorization in Actual (self-hosted open-source budgeting app) before 26.7.0 lets any shared user holding only user_access on a budget file invoke owner-only file-management endpoints. Because requireFileAccess treats ordinary shared access as sufficient, a low-privileged collaborator can call /delete-user-file, /reset-user-file, and /user-create-key to destroy or reset another user's budget data or rotate its encryption key. No public exploit is identified at time of analysis, and it is not in CISA KEV.

Technical ContextAI

Actual is a Node.js-based personal-finance/budgeting server that supports multi-user sharing of budget files, where each file has an owner plus users granted various access levels (e.g. read/write user_access). The flaw is a CWE-862 Missing Authorization: the shared server-side middleware requireFileAccess is meant to gate file-management routes but only verifies that the caller has some access to the file, not that they hold the owner or administrator role the destructive operations require. As a result the authorization check enforces the wrong privilege tier - presence-of-access is conflated with ownership - so file-lifecycle endpoints (delete, reset, key creation) accept requests from non-owner collaborators. The CPE cpe:2.3:a:actualbudget:actual identifies all released versions prior to the 26.7.0 fix as affected.

RemediationAI

Vendor-released patch: upgrade Actual to version 26.7.0 or later, which corrects requireFileAccess to enforce owner/administrator privileges on file-management operations (see advisory GHSA-23vm-ffgg-qvjr and fixing commits 18a8dc03c48eeb2e8252669a80673e6a9933b5fd and 3b9e79ed5ee795a80bbae214d6ebb2755289d7f2). If you cannot upgrade immediately, reduce exposure by revoking or minimizing shared user_access grants so only trusted parties can reach the affected instance, and avoid sharing budget files with untrusted users; where feasible, restrict network reach to the /delete-user-file, /reset-user-file, and /user-create-key endpoints via a reverse proxy so only administrators can invoke them. The trade-off of these workarounds is loss of legitimate multi-user collaboration and added proxy-rule maintenance, so treat them as stopgaps until the 26.7.0 upgrade is applied.