@actual-app/sync-server@26.7.0-nightly.20260604

@actual-app/sync-server is an actual syncing server

Affected versions of this package are vulnerable to Missing Authorization via the requireFileAccess check in the sync-server handlers for /delete-user-file, /reset-user-file, and /user-create-key. An attacker can delete, reset, or rekey another user’s hosted budget file by sending those endpoints a valid session and a file they only have shared user_access to. The affected code treats shared collaboration access as sufficient for owner-only management actions, so a non-owner collaborator can change the file’s deleted state, reset its sync metadata, or overwrite its encryption key. This lets a lower-privileged user perform destructive file-management operations on a file they do not own.

Notes

• The issue is limited to hosted-file management flow in sync-server and does not imply the broader collaboration endpoints that still rely on shared access for ordinary sync/upload/download operations.

Workarounds

• Restrict access to the sync-server file-management endpoints /delete-user-file, /reset-user-file, and /user-create-key so only file owners or admins can use them; this prevents shared user_access collaborators from deleting a hosted budget file, resetting its sync state, or rewriting its encryption key.

Upgrade @actual-app/sync-server to version 26.7.0 or higher.