https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 21:32:35 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-46700 <p>Actual is a local-first personal finance tool. Prior to 26.6.0, the GET /secret/:name endpoint in @actual-app/sync-server checks only that the caller has a valid session and does not verify the caller is an admin, while the sibling POST /secret/ handler enforces an admin check in OpenID mode. Any authenticated non-admin BASIC user in OpenID multi-user deployments can probe the secrets store and learn which admin-managed bank-sync integrations have been configured, including simplefin_accessKey, pluggyai_clientSecret, pluggyai_itemIds, and the gocardless secrets. This issue is fixed in version 26.6.0.</p> <p>Actual is a local-first personal finance tool. Prior to 26.6.0, the GET /secret/:name endpoint in @actual-app/sync-server checks only that the caller has a valid session and does not verify the caller is an admin, while the sibling POST /secret/ handler enforces an admin check in OpenID mode. Any authenticated non-admin BASIC user in OpenID multi-user deployments can probe the secrets store and learn which admin-managed bank-sync integrations have been configured, including simplefin_accessKey, pluggyai_clientSecret, pluggyai_itemIds, and the gocardless secrets. This issue is fixed in version 26.6.0.</p> https://db.gcve.eu/vuln/fkie_cve-2026-46700 https://db.gcve.eu/vuln/ghsa-3f62-qv96-4p78 <p><strong>Affected:</strong> npm: @actual-app/sync-server</p> <p>## Summary</p> <p>In `@actual-app/sync-server`, the `GET /secret/:name` endpoint (`app-secrets.js:53`) checks only that the caller has a valid session — it does not verify the caller is an admin. The sibling `POST /secret/` handler does enforce an admin check in OpenID mode, exposing an authorization asymmetry. Any authenticated non-admin (BASIC) user in OpenID multi-user deployments can probe the secrets store and learn which admin-managed bank-sync integrations have been configured (existence, not values). This includes integration credentials that are not otherwise observable to non-admins, such as `simplefin_accessKey`, `pluggyai_clientSecret`, `pluggyai_itemIds`, and the `gocardless_*` secrets.</p> <p>## Details</p> <p>`packages/sync-server/src/app-secrets.js` mounts `validateSessionMiddleware` at the router level (line 15), so all handlers inherit only &#34;must be authenticated.&#34; The POST handler then explicitly upgrades to an admin check when the active auth method is `openid`:</p> <p>```js // app-secrets.js:17-46 app.post(&#39;/&#39;, async (req, res) =&gt; { // ... look up active auth method ... if (method === &#39;openid&#39;) { const canSaveSecrets = isAdmin(res.locals.user_id); if (!canSaveSecrets) { res.status(403).send({ status: &#39;error&#39;, reason: &#39;not-admin&#39;, details: &#39;You have to be admin to set secrets&#39;, }); return; } } secretsService.set(name, value); // ... }); ```</p> <p>The sibling GET handler skips both the method check and the admin check ent…</p> <p><strong>Affected:</strong> npm: @actual-app/sync-server</p> <p>## Summary</p> <p>In `@actual-app/sync-server`, the `GET /secret/:name` endpoint (`app-secrets.js:53`) checks only that the caller has a valid session — it does not verify the caller is an admin. The sibling `POST /secret/` handler does enforce an admin check in OpenID mode, exposing an authorization asymmetry. Any authenticated non-admin (BASIC) user in OpenID multi-user deployments can probe the secrets store and learn which admin-managed bank-sync integrations have been configured (existence, not values). This includes integration credentials that are not otherwise observable to non-admins, such as `simplefin_accessKey`, `pluggyai_clientSecret`, `pluggyai_itemIds`, and the `gocardless_*` secrets.</p> <p>## Details</p> <p>`packages/sync-server/src/app-secrets.js` mounts `validateSessionMiddleware` at the router level (line 15), so all handlers inherit only &#34;must be authenticated.&#34; The POST handler then explicitly upgrades to an admin check when the active auth method is `openid`:</p> <p>```js // app-secrets.js:17-46 app.post(&#39;/&#39;, async (req, res) =&gt; { // ... look up active auth method ... if (method === &#39;openid&#39;) { const canSaveSecrets = isAdmin(res.locals.user_id); if (!canSaveSecrets) { res.status(403).send({ status: &#39;error&#39;, reason: &#39;not-admin&#39;, details: &#39;You have to be admin to set secrets&#39;, }); return; } } secretsService.set(name, value); // ... }); ```</p> <p>The sibling GET handler skips both the method check and the admin check ent…</p> https://db.gcve.eu/vuln/ghsa-3f62-qv96-4p78