The vulnerability (CVE-2026-46700) in actualbudget actual affects versions prior to 26.6.0. The GET /secret/:name endpoint in the @actual-app/sync-server component only checks for a valid session but does not enforce an admin authorization check, unlike the POST /secret/ handler which does enforce admin checks in OpenID mode. As a result, any authenticated non-admin BASIC user can probe the secrets store and discover sensitive admin-managed secrets such as simplefin_accessKey, pluggyai_clientSecret, pluggyai_itemIds, and gocardless secrets. This improper authorization (CWE-285) could lead to unauthorized disclosure of sensitive configuration data. The vulnerability is resolved in version 26.6.0.

The vulnerability allows authenticated non-admin users to access sensitive secrets related to bank-sync integrations managed by admins. This could lead to unauthorized disclosure of confidential credentials and secrets, potentially compromising integrations with financial services. There is no indication of integrity or availability impact. The CVSS score is 4.3 (medium severity), reflecting limited confidentiality impact with low attack complexity and no user interaction required.

This vulnerability is fixed in actualbudget actual version 26.6.0. Users should upgrade to version 26.6.0 or later to ensure the GET /secret/:name endpoint properly enforces admin authorization. No other mitigation or temporary workaround is indicated.