A critical vulnerability in ActualBudget Actual allows any authenticated user to escalate privileges to administrator status, posing a significant risk to the integrity and confidentiality of financial data.

This vulnerability involves an improper access control flaw where an authenticated user can escalate their privileges to the administrator level. The attack involves a chain of three weaknesses: an unauthorized password change endpoint, a failure to remove orphaned password data during OpenID Connect migration, and a client-controlled login method that bypasses server-side authentication configurations.

The exploitation of this vulnerability permits unauthorized users to gain full administrative control over the Actual budget server. This level of access grants the attacker the ability to view sensitive financial records, modify account settings, and potentially disrupt service availability. With a CVSS score of 8.8, this flaw is categorized as High severity, necessitating immediate attention to prevent unauthorized access to financial data.

Immediate Action: Update the @actual-app/sync-server package to version 26.4.0 or later immediately to incorporate the necessary security patches.

Proactive Monitoring: Review server access logs for suspicious POST requests targeting the /account/change-password endpoint and monitor for unexpected changes to user role assignments.

Compensating Controls: Implement strict network-level access controls to limit exposure of the sync-server to only known, trusted IP addresses while the update is being staged.

Public Exploit Available: No (There is no confirmed public exploit or weaponized module available; the CISA SSVC assessment identifies a proof-of-concept existence, which signifies a credible threat).

Given the potential for complete administrative takeover of the financial management platform, administrators must prioritize upgrading to version 26.4.0. Failure to patch allows any authenticated user to compromise the server environment. Ensure all instances are updated promptly to neutralize this privilege escalation path and secure stored financial information.