Actualbudget Actual versions before 26.4.0 contain an improper access control vulnerability (CWE-284) that enables privilege escalation from BASIC to ADMIN roles on migrated servers. The vulnerability arises from a missing authorization check on the POST /account/change-password endpoint, allowing any authenticated session to overwrite password hashes. This is exploitable only if an inactive password authentication record remains after migration from password to OpenID Connect authentication, and if the login endpoint accepts a client-supplied loginMethod parameter forcing password-based authentication. These three weaknesses must be chained sequentially to achieve administrative access. The root cause is the missing authorization check on the password change endpoint. Version 26.4.0 includes a fix for this issue.

Successful exploitation allows an authenticated user with BASIC privileges to escalate to ADMIN privileges, potentially compromising the entire server instance and all user data managed by Actual. The vulnerability affects confidentiality, integrity, and availability (CIA) with high impact scores. No known exploits in the wild have been reported as of the published date.

Upgrade to Actual version 26.4.0 or later, which contains a fix for this vulnerability. Since this is a local software product (not a cloud service), remediation requires applying the official update. Patch status is not explicitly stated in the vendor advisory, but version 26.4.0 is confirmed to contain the fix. Until upgraded, restrict access to authenticated users and monitor for suspicious password change requests if possible.