Local Security Flaw in Actual Personal Finance Tool Affects User Privileges

CVE-2026-33318

What is CVE-2026-33318?

The Actual Personal Finance Tool has a serious vulnerability that allows authenticated users, even those with a BASIC role, to escalate privileges to ADMIN on servers transitioned from password authentication to OpenID Connect. This occurs due to a combination of three specific weaknesses: the absence of an authorization check on the password change endpoint, the retention of inactive password entries after migration, and a client-controlled login method that circumvents active authentication configurations. This exploit requires a precise sequence of steps to be effective; without the combination, each weakness alone does not allow for privilege escalation. Version 26.4.0 includes a fix to address these issues, underscoring the importance of software updates to maintain system security.

References