CVE-2026-50007 - Actual: Shared users can perform owner-only file management actions

Back Back to CVE browser

HIGH

Actual: Shared users can perform owner-only file management actions

Published Jul 7, 2026

7.2

HIGH

CVSS 4.0

EPSS 0.43%

Description

Actual is an open-source personal finance application. Prior to 26.7.0, a missing authorization issue allows a shared user with user_access on a budget file to perform owner-only file management actions. A non-owner shared user can call file-management endpoints intended for higher-privilege users, including /delete-user-file, /reset-user-file, and /user-create-key, because requireFileAccess treats ordinary shared access as sufficient for file-management operations that should be restricted to the file owner or an administrator. This issue is fixed in version 26.7.0.

Affected products

Vendor Actualbudget Product Actual Default
n/a
- Version
  < 26.7.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Actualbudget

Actual

n/a

Version	Status	Constraints
< 26.7.0	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-862

Missing Authorization

References (5)

https://github.com/actualbudget/actual/commit/18a8dc03c48eeb2e8252669a80673e6a9933b5fd
x_refsource_MISC
https://github.com/actualbudget/actual/commit/3b9e79ed5ee795a80bbae214d6ebb2755289d7f2
x_refsource_MISC
https://github.com/actualbudget/actual/pull/7977
x_refsource_MISC
https://github.com/actualbudget/actual/pull/8333
x_refsource_MISC
https://github.com/actualbudget/actual/security/advisories/GHSA-23vm-ffgg-qvjr
exploitx_refsource_CONFIRM

Link	Providers	Tags
https://github.com/actualbudget/actual/commit/18a8dc03c48eeb2e8252669a80673e6a9933b5fd		x_refsource_MISC
https://github.com/actualbudget/actual/commit/3b9e79ed5ee795a80bbae214d6ebb2755289d7f2		x_refsource_MISC
https://github.com/actualbudget/actual/pull/7977		x_refsource_MISC
https://github.com/actualbudget/actual/pull/8333		x_refsource_MISC
https://github.com/actualbudget/actual/security/advisories/GHSA-23vm-ffgg-qvjr		exploitx_refsource_CONFIRM