Is CVE-2026-46700 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-46700?

CVE-2026-46700 has a CVSS v3 severity of MEDIUM (4.3).

Back

CVE-2026-46700

Description

Actual is a local-first personal finance tool. Prior to 26.6.0, the GET /secret/:name endpoint in @actual-app/sync-server checks only that the caller has a valid session and does not verify the caller is an admin, while the sibling POST /secret/ handler enforces an admin check in OpenID mode. Any authenticated non-admin BASIC user in OpenID multi-user deployments can probe the secrets store and learn which admin-managed bank-sync integrations have been configured, including simplefin_accessKey, pluggyai_clientSecret, pluggyai_itemIds, and the gocardless secrets. This issue is fixed in version 26.6.0.