CVE-2026-46700: @actual app/sync server Name Allows Non-admin OpenID Users Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-3f62-qv96-4p78",
  "modified" : "2026-06-22T21:42:34Z",
  "published" : "2026-06-22T21:42:34Z",
  "aliases" : [ "CVE-2026-46700" ],
  "summary" : "@actual-app/sync-server's missing authorization on GET /secret/:name allows non-admin OpenID users to enumerate admin-configured bank-sync secrets",
  "details" : "## Summary\n\nIn `@actual-app/sync-server`, the `GET /secret/:name` endpoint (`app-secrets.js:53`) checks only that the caller has a valid session — it does not verify the caller is an admin. The sibling `POST /secret/` handler does enforce an admin check in OpenID mode, exposing an authorization asymmetry. Any authenticated non-admin (BASIC) user in OpenID multi-user deployments can probe the secrets store and learn which admin-managed bank-sync integrations have been configured (existence, not values). This includes integration credentials that are not otherwise observable to non-admins, such as `simplefin_accessKey`, `pluggyai_clientSecret`, `pluggyai_itemIds`, and the `gocardless_*` secrets.\n\n## Details\n\n`packages/sync-server/src/app-secrets.js` mounts `validateSessionMiddleware` at the router level (line 15), so all handlers inherit only \"must be authenticated.\" The POST handler then explicitly upgrades to an admin check when the active auth method is `openid`:\n\n```js\n// app-secrets.js:17-46\napp.post('/', async (req, res) => {\n  // ... look up active auth method ...\n  if (method === 'openid') {\n    const canSaveSecrets = isAdmin(res.locals.user_id);\n    if (!canSaveSecrets) {\n      res.status(403).send({\n        status: 'error',\n        reason: 'not-admin',\n        details: 'You have to be admin to set secrets',\n      });\n      return;\n    }\n  }\n  secretsService.set(name, value);\n  // ...\n});\n```\n\nThe sibling GET handler skips both the method check and the admin check entirely:\n\n```js\n// app-secrets.js:53-61\napp.get('/:name', async (req, res) => {\n  const name = req.params.name;\n  const keyExists = secretsService.exists(name);\n  if (keyExists) {\n    res.sendStatus(204);\n  } else {\n    res.status(404).send('key not found');\n  }\n});\n```\n\nThe intent — visible from the POST handler's \"You have to be admin to set secrets\" — is that this store holds admin-managed credentials. The valid secret names enumerated in `services/secrets-service.js` (`SecretName`) are: `gocardless_secretId`, `gocardless_secretKey`, `simplefin_token`, `simplefin_accessKey`, `pluggyai_clientId`, `pluggyai_clientSecret`, `pluggyai_itemIds`.\n\nIn OpenID mode, BASIC users obtain valid sessions through `packages/sync-server/src/accounts/openid.ts:264-274` — either auto-created (`userCreationMode=login`) or pre-provisioned by the admin (`userCreationMode=manual`). With that BASIC session token they can hit `GET /secret/:name` and distinguish 204 (configured) from 404 (missing), enumerating each admin-managed secret name. Some signals (`simplefin_token` existence, `pluggyai_clientId` existence) are already coarsely observable via the unauthenticated bank-sync status endpoints (`app-simplefin.js:18`, `app-pluggyai.js:18`); the rest (`simplefin_accessKey`, `pluggyai_clientSecret`, `pluggyai_itemIds`, both `gocardless_*` secrets) are not otherwise probeable.\n\nThis is structurally identical to the previously reported missing-admin-check on `GET /admin/users/` (`app-admin.js:28`): a POST sibling enforces admin authorization while the GET sibling omits it.\n\n## PoC\n\nPre-requisites:\n- Server is configured for OpenID multi-user mode (`ACTUAL_OPENID_ENFORCE=true` or auth method is `openid`).\n- An admin has configured one or more bank-sync integrations.\n- The attacker is any authenticated BASIC user (auto-created via `userCreationMode=login`, or admin-provisioned in the default `manual` mode).\n\nStep 1 — capture a BASIC user's session token in `$TOKEN` (standard OpenID login flow, no admin role required).\n\nStep 2 — probe each admin-managed secret name:\n\n```bash\nfor name in gocardless_secretId gocardless_secretKey \\\n            simplefin_token simplefin_accessKey \\\n            pluggyai_clientId pluggyai_clientSecret pluggyai_itemIds; do\n  status=$(curl -s -o /dev/null -w '%{http_code}' \\\n           -H \"X-ACTUAL-TOKEN: $TOKEN\" \\\n           https://actual.example.com/secret/$name)\n  echo \"$name -> $status\"   # 204 = configured, 404 = missing\ndone\n```\n\nStep 3 — confirm the asymmetry by attempting to write a secret (correctly rejected for non-admins):\n\n```bash\ncurl -s -H \"X-ACTUAL-TOKEN: $TOKEN\" \\\n     -H 'Content-Type: application/json' \\\n     -d '{\"name\":\"pluggyai_itemIds\",\"value\":\"x\"}' \\\n     https://actual.example.com/secret/\n# {\"status\":\"error\",\"reason\":\"not-admin\",\"details\":\"You have to be admin to set secrets\"}\n```\n\nThe POST returns 403 `not-admin`; the GET returns 204/404 unauthenticated-against-role.\n\n## Impact\n\n- A non-admin authenticated user in OpenID multi-user mode can enumerate which admin-managed bank-sync integrations the deployment uses.\n- This reveals whether GoCardless, SimpleFIN, and/or Pluggy AI are configured, and which auxiliary credentials the admin has set (e.g. `simplefin_accessKey`, `pluggyai_clientSecret`, `pluggyai_itemIds`) — none of which are otherwise observable to non-admins.\n- The disclosure is existence-only; secret values are not returned. Impact is limited to recon useful for targeted follow-on attacks (e.g. credential phishing, picking which integration to attack on a separate vulnerability).\n- No integrity or availability impact.\n\n## Recommended Fix\n\nMirror the POST handler's admin gate on the GET handler. Minimal patch in `packages/sync-server/src/app-secrets.js`:\n\n```js\napp.get('/:name', async (req, res) => {\n  let method;\n  try {\n    const result = getAccountDb().first(\n      'SELECT method FROM auth WHERE active = 1',\n    );\n    method = result?.method;\n  } catch (error) {\n    console.error('Failed to fetch auth method:', error);\n    return res.status(500).send({\n      status: 'error',\n      reason: 'database-error',\n      details: 'Failed to validate authentication method',\n    });\n  }\n\n  if (method === 'openid' && !isAdmin(res.locals.user_id)) {\n    return res.status(403).send({\n      status: 'error',\n      reason: 'not-admin',\n      details: 'You have to be admin to read secret status',\n    });\n  }\n\n  const name = req.params.name;\n  const keyExists = secretsService.exists(name);\n  if (keyExists) {\n    res.sendStatus(204);\n  } else {\n    res.status(404).send('key not found');\n  }\n});\n```\n\nConsider factoring the method-lookup + admin-check into a shared helper used by both POST and GET to prevent the same asymmetry from recurring. Also consider restricting `:name` to the `SecretName` enum so unrelated probing is rejected up front.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "@actual-app/sync-server"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "26.6.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/actualbudget/actual/security/advisories/GHSA-3f62-qv96-4p78"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/actualbudget/actual"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-285" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-06-22T21:42:34Z",
    "nvd_published_at" : null
  }
}