Missing Authorization Affecting @actual-app/sync-server package, versions <26.7.0
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Missing Authorization vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-JS-ACTUALAPPSYNCSERVER-17905239
- published9 Jul 2026
- disclosed7 Jul 2026
- creditDongyangLyu
Introduced: 7 Jul 2026
NewCVE-2026-50007 (opens in a new tab)How to fix?
Upgrade @actual-app/sync-server to version 26.7.0 or higher.
Overview
@actual-app/sync-server is an actual syncing server
Affected versions of this package are vulnerable to Missing Authorization via the requireFileAccess check in the sync-server handlers for /delete-user-file, /reset-user-file, and /user-create-key. An attacker can delete, reset, or rekey another user’s hosted budget file by sending those endpoints a valid session and a file they only have shared user_access to. The affected code treats shared collaboration access as sufficient for owner-only management actions, so a non-owner collaborator can change the file’s deleted state, reset its sync metadata, or overwrite its encryption key. This lets a lower-privileged user perform destructive file-management operations on a file they do not own.
Notes
- The issue is limited to hosted-file management flow in
sync-serverand does not imply the broader collaboration endpoints that still rely on shared access for ordinary sync/upload/download operations.
Workarounds
- Restrict access to the
sync-serverfile-management endpoints/delete-user-file,/reset-user-file, and/user-create-keyso only file owners or admins can use them; this prevents shareduser_accesscollaborators from deleting a hosted budget file, resetting its sync state, or rewriting its encryption key.