CVE-2026-33318 - Vulnerability Analysis

Overview

Actual < 26.4.0 contains a broken access control vulnerability caused by missing authorization on POST /account/change-password combined with orphaned password rows and client-controlled loginMethod, letting authenticated users escalate to ADMIN on migrated servers, exploit requires chained conditions.

Severity & Score

Impact

Authenticated users can escalate privileges to ADMIN, compromising server control and sensitive data.

Mitigation

Update to version 26.4.0 or later.

References

• https://actualbudget.org/blog/release-26.4.0
• https://github.com/actualbudget/actual/security/advisories/GHSA-prp4-2f49-fcgp

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner