Missing Authorization@actual-app/sync-server is an actual syncing server
Affected versions of this package are vulnerable to Missing Authorization via the requireFileAccess check in the sync-server handlers for /delete-user-file, /reset-user-file, and /user-create-key. An attacker can delete, reset, or rekey another user’s hosted budget file by sending those endpoints a valid session and a file they only have shared user_access to. The affected code treats shared collaboration access as sufficient for owner-only management actions, so a non-owner collaborator can change the file’s deleted state, reset its sync metadata, or overwrite its encryption key. This lets a lower-privileged user perform destructive file-management operations on a file they do not own.
Notes
- The issue is limited to hosted-file management flow in
sync-server and does not imply the broader collaboration endpoints that still rely on shared access for ordinary sync/upload/download operations.
Workarounds
- Restrict access to the
sync-server file-management endpoints /delete-user-file, /reset-user-file, and /user-create-key so only file owners or admins can use them; this prevents shared user_access collaborators from deleting a hosted budget file, resetting its sync state, or rewriting its encryption key.
How to fix Missing Authorization? Upgrade @actual-app/sync-server to version 26.7.0 or higher.
| |
Incorrect Authorization@actual-app/sync-server is an actual syncing server
Affected versions of this package are vulnerable to Incorrect Authorization through the /openid/config endpoint, which exposes sensitive OpenID Connect configuration data, including the OAuth2 client_secret, to any caller who knows the bootstrap password. The endpoint lacks authentication and rate limiting, allowing an attacker to obtain confidential credentials by brute-forcing the bootstrap password.
How to fix Incorrect Authorization? Upgrade @actual-app/sync-server to version 26.5.0 or higher.
| |
Improper Authorization@actual-app/sync-server is an actual syncing server
Affected versions of this package are vulnerable to Improper Authorization in the GET /secret/:name process. An attacker can determine the existence of admin-configured secrets by sending authenticated requests as a non-admin user and observing the response codes. This is only exploitable if the server is configured in OpenID multi-user mode and the attacker has a valid non-admin session.
How to fix Improper Authorization? Upgrade @actual-app/sync-server to version 26.6.0 or higher.
| |
Insufficient Session Expiration@actual-app/sync-server is an actual syncing server
Affected versions of this package are vulnerable to Insufficient Session Expiration due to the lack of user status verification in the validateSession process. An attacker can maintain unauthorized access to server endpoints and sensitive data by reusing a valid session token after the associated user account has been disabled. This is only exploitable if the session token has not expired, which is the default configuration where token expiration is set to 'never'.
How to fix Insufficient Session Expiration? Upgrade @actual-app/sync-server to version 26.6.0 or higher.
| |
