CVE-2026-49229: CWE-613: Insufficient Session Expiration in actualbudget actual
Actual is a local-first personal finance app. Prior to 26.6.0, in OpenID multi-user mode, disabling a user only blocks future OpenID login for that identity, while existing Actual session tokens for the disabled user remain valid. The shared session validation path accepts any existing token row that has not expired without checking whether the associated user is still enabled, allowing a disabled user to continue calling authenticated server endpoints. This issue is fixed in version 26.6.0.
AI Analysis
Technical Summary
The vulnerability (CVE-2026-49229) in Actualbudget's Actual app involves insufficient session expiration controls (CWE-613). When a user is disabled in OpenID multi-user mode, only future login attempts are blocked, but existing session tokens remain valid because the session validation process does not verify if the user is still enabled. This allows a disabled user to maintain access to authenticated endpoints until their session token naturally expires. The vulnerability is resolved in Actual version 26.6.0.
Potential Impact
An attacker or user whose account has been disabled can continue to access authenticated server endpoints using existing valid session tokens. This results in unauthorized access to potentially sensitive personal finance data, impacting confidentiality and integrity. The CVSS 3.1 score is 8.3 (high), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high confidentiality and integrity impact with low availability impact.
Mitigation Recommendations
Upgrade to Actual version 26.6.0 or later, where this vulnerability is fixed by properly invalidating session tokens of disabled users. Since this is a local app and not a cloud service, users must apply the update themselves. Patch status is confirmed fixed in 26.6.0.
CVE-2026-49229: CWE-613: Insufficient Session Expiration in actualbudget actual
Description
Actual is a local-first personal finance app. Prior to 26.6.0, in OpenID multi-user mode, disabling a user only blocks future OpenID login for that identity, while existing Actual session tokens for the disabled user remain valid. The shared session validation path accepts any existing token row that has not expired without checking whether the associated user is still enabled, allowing a disabled user to continue calling authenticated server endpoints. This issue is fixed in version 26.6.0.
CVSS v3.1
Score 8.3high
Affected software
pkg:github/actualbudget/actualRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability (CVE-2026-49229) in Actualbudget's Actual app involves insufficient session expiration controls (CWE-613). When a user is disabled in OpenID multi-user mode, only future login attempts are blocked, but existing session tokens remain valid because the session validation process does not verify if the user is still enabled. This allows a disabled user to maintain access to authenticated endpoints until their session token naturally expires. The vulnerability is resolved in Actual version 26.6.0.
Potential Impact
An attacker or user whose account has been disabled can continue to access authenticated server endpoints using existing valid session tokens. This results in unauthorized access to potentially sensitive personal finance data, impacting confidentiality and integrity. The CVSS 3.1 score is 8.3 (high), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high confidentiality and integrity impact with low availability impact.
Mitigation Recommendations
Upgrade to Actual version 26.6.0 or later, where this vulnerability is fixed by properly invalidating session tokens of disabled users. Since this is a local app and not a cloud service, users must apply the update themselves. Patch status is confirmed fixed in 26.6.0.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-28T03:42:34.342Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a4d7350c9d9e3dbe3e36b06
Added to database: 07/07/2026, 21:44:48 UTC
Last enriched: 07/15/2026, 11:56:07 UTC
Last updated: 08/20/2026, 22:52:13 UTC
Views: 119
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.