CVE-2026-49229 actualbudget CVE debrief

Who should care

Users of Actual local-first personal finance app, especially those using OpenID multi-user mode, should be aware of this vulnerability and ensure they are running version 26.6.0 or later. Operators, platform administrators, vulnerability management teams, and security teams should review the affected product deployments and plan vendor-supported updates or mitigations.

Technical summary

In Actual local-first personal finance app, prior to version 26.6.0, the shared session validation path accepted any existing token row that had not expired without checking whether the associated user was still enabled. This allowed a disabled user to continue calling authenticated server endpoints. The issue is fixed in version 26.6.0. The vulnerability has a CVSS score of 8.3 and a severity of HIGH.

Defensive priority

High priority for users of Actual local-first personal finance app in OpenID multi-user mode.

Recommended defensive actions

• Upgrade to version 26.6.0 or later
• Review and invalidate existing session tokens for disabled users
• Monitor for suspicious activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

Evidence from the CVE record and NVD detail indicate that the vulnerability was fixed in version 26.6.0. However, there is limited information on the exact impact and affected scope. The vulnerability allows a disabled user to continue calling authenticated server endpoints due to the shared session validation path accepting any existing token row that has not expired without checking whether the associated user is still enabled. Defenders should verify the affected product deployments, review official advisories, and plan vendor-supported updates or mitigations. They should also review compensating controls for exposed systems and check relevant monitoring, detection, and logs for exposed assets.

Official resources