If you share an Actual Budget server with anyone — a partner, a roommate, a small team — that person could have quietly promoted themselves to full administrator of your financial data without you ever knowing.
Who Is at Risk and Why It Matters
Actual Budget is a popular open-source, local-first personal finance tool used by tens of thousands of privacy-conscious individuals, households, and small organizations who want full control over their financial data without handing it to a cloud service like Mint or YNAB. Many users run their own Actual server at home or on a private VPS and invite family members or colleagues to share access under restricted "basic" accounts — precisely to limit what those users can see or change.
The vulnerability, tracked as CVE-2026-33318 and rated 8.8 out of 10 (HIGH) on the severity scale, shatters that trust model entirely. Any user with even the most limited login credentials can silently rewrite the rules and take over the entire server. That means full access to every budget, every transaction, every linked account, and every connected financial record stored on that instance.
What an Attacker Can Actually Do — In Plain English
Imagine you run a shared household budget server. You give your roommate a basic account so they can log expenses, but nothing more. Unknown to you, Actual has a hidden back door baked into how it handles a very specific migration scenario — specifically, servers that were upgraded from a simple username-and-password login system to a more modern, centralized sign-on system (the kind big companies use so employees log in once for everything). When that upgrade happens, the old password system isn't fully cleaned up. It's just switched off — but the door is still there, unlocked, with the hinges intact.
Your roommate, with their basic account, can quietly send a special request to the server telling it to overwrite the administrator's password with something they choose. The server has no guard on that door — it doesn't check whether the person making the request is actually allowed to change passwords at all. Your roommate sets a new password, then tells the server to use the old login method instead of the new one, and walks straight in as administrator. From there, they can do anything: export all your financial history, modify records, lock you out, or delete everything. The whole attack takes seconds and leaves no obvious trace.
What makes this particularly nasty is that it's not a single bug — it's three separate design oversights that happen to line up perfectly, like tumblers in a lock falling into place. Each one alone might be harmless. Together, they hand over the keys to the kingdom.
The Technical Detail Security Researchers Need to Know
The root of the vulnerability is a missing authorization check on the POST /account/change-password endpoint. This endpoint performs no role validation whatsoever, allowing any authenticated session — regardless of privilege level — to overwrite the stored password hash in the database. This is compounded by two additional weaknesses: the legacy password authentication row in the auth table is never purged during OpenID Connect migration (leaving a dormant but exploitable credential pathway), and the login endpoint at /account/login accepts a client-supplied loginMethod parameter that overrides the server's active authentication configuration entirely. The combination constitutes a three-stage privilege escalation chain: hash overwrite → dormant auth row reactivation → forced method downgrade. CVSS score: 8.8 HIGH.
Real-World Context: Discovered, Not Yet Exploited
As of publication, there are no confirmed reports of this vulnerability being actively exploited in the wild. However, security teams and server administrators should treat the lack of confirmed exploitation as a narrow window of opportunity, not a reason to delay. The flaw is straightforward enough that a moderately skilled attacker — or even a curious user who stumbles across the right documentation — could reproduce it without specialized tools.
The vulnerability was responsibly disclosed and patched by the Actual Budget maintainers, who released version 26.4.0 to address all three weaknesses simultaneously. Credit goes to the researchers who identified the chained nature of the flaw and worked with the project team on remediation. Actual's open-source codebase means that once the patch is public, the diff is readable by anyone — including those looking for ways to exploit unpatched servers.
The affected population is specifically servers that were migrated from password authentication to OpenID Connect. Pure password-auth servers and fresh OpenID Connect installs that were never migrated are not exposed in the same way — though all users should update regardless as a matter of good hygiene.
What You Should Do Right Now
-
Update to Actual Budget version 26.4.0 immediately. If you're running a self-hosted instance via Docker, pull the latest image (
docker pull actualbudget/actual-server:26.4.0or uselatestif you track that tag) and restart your container. If you installed via Node, runnpm update @actual-app/serverand confirm the version number in your logs on startup. Do not wait for your next scheduled maintenance window. - Audit who has access to your server. Log into your Actual admin panel and review every user account. If you see any accounts you don't recognize, or if any basic-role accounts have been mysteriously upgraded to admin, treat your server as compromised: rotate all credentials, revoke all sessions, and review your exported financial data for unauthorized changes. Consider whether your OpenID Connect provider shows any unexpected login events in its own logs.
- Restrict network access to your Actual server while you patch. If your instance is exposed to the public internet or to a shared network with untrusted users, put it behind a VPN or firewall rule that limits access to known IP addresses until you have confirmed the update is applied. Even a few hours of exposure on an unpatched, migrated server is enough for this attack to occur — it requires no special tools, only a valid login.
CVE: CVE-2026-33318 | CVSS: 8.8 HIGH | Fixed in: Actual Budget 26.4.0 | Category: Privilege Escalation / Authentication Bypass