A critical authorization flaw in Actual Budget enables any authenticated user to read, modify, or overwrite the financial data of other users, posing a severe risk to data integrity and confidentiality.

The application fails to perform proper authorization checks on sync API endpoints when operating in multi-user OpenID mode. This allows any authenticated user to supply a target file ID and perform unauthorized operations on budgets they do not own.

The ability for unauthorized users to modify or overwrite budget files leads to a total compromise of financial data integrity and potential unauthorized disclosure of sensitive personal financial information. Given the CVSS score of 7.1, this vulnerability is classified as High severity, as it facilitates unauthorized data manipulation without requiring elevated administrative privileges.

Immediate Action: Update the Actual Budget instance to version 26.2.1 or later to implement the necessary authorization checks on the sync API.

Proactive Monitoring: Review application access logs for unusual patterns of file ID requests or unauthorized attempts to access budget files owned by different user accounts.

Compensating Controls: If immediate patching is not possible, restrict access to the multi-user sync server via network-level controls or a WAF to limit exposure until the update is applied.

Public Exploit Available: Unknown.

This vulnerability represents a significant security oversight in the multi-user synchronization mechanism of the Actual Budget software. Because the flaw allows for the arbitrary modification of user financial records, administrators should prioritize updating to version 26.2.1 immediately to prevent potential data loss or unauthorized access.