CVE-2026-49229 describes a vulnerability in the Actualbudget Actual app before version 26.6.0 where disabling a user in OpenID multi-user mode only prevents future logins but does not invalidate existing session tokens. The session validation process accepts any unexpired token without verifying if the associated user is still enabled, enabling disabled users to maintain authenticated access to server endpoints. This is classified as CWE-613 (Insufficient Session Expiration). The vulnerability has a CVSS 3.1 score of 8.3, indicating high severity. The issue is resolved in version 26.6.0.

An attacker or disabled user can continue to use valid session tokens to access authenticated server endpoints even after their user account has been disabled. This can lead to unauthorized access to sensitive personal finance data and potentially compromise confidentiality and integrity. The vulnerability has a high severity rating with a CVSS score of 8.3, reflecting the potential for significant impact on confidentiality and integrity with low attack complexity and no user interaction required.

Upgrade to Actual version 26.6.0 or later, where the issue is fixed by properly invalidating session tokens for disabled users. Since the vendor advisory confirms the fix in version 26.6.0, applying this official update is the recommended remediation. No other mitigation guidance is provided or necessary.