CVE-2026-49229

HighCVSS 8.3/10Last modified Jul 9, 2026

Description

Actual is a local-first personal finance app. Prior to 26.6.0, in OpenID multi-user mode, disabling a user only blocks future OpenID login for that identity, while existing Actual session tokens for the disabled user remain valid. The shared session validation path accepts any existing token row that has not expired without checking whether the associated user is still enabled, allowing a disabled user to continue calling authenticated server endpoints. This issue is fixed in version 26.6.0.

Metrics

CVSS 3.1 8.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Weakness enumeration

CWE-613

Affected software

No affected versions have been published.

Timeline

Published: Jul 7, 2026
Last modified: Jul 9, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-49235.9Impact: When using multiple wildcards, combined with at least one parameter, a regular expression can be generated that is vulnerable to Re CVE-2026-492309.1Improper Validation of Integrity Check Value vulnerability in Apache APISIX. The jwe-decrypt plugin under default configuration is vulnerab CVE-2026-492315.4Authentication Bypass by Spoofing vulnerability in opa plugin. An attacker could relay spoofed identity headers to upstream capitalising on CVE-2026-492328.7Routinator exits on any error when accepting incoming HTTP or RTR connections, including ones it can recover from such as running out of fil CVE-2026-492337.5Routinator does not properly check the module component of rsync URIs, which are used to create the file system paths for the Routinator cac CVE-2026-492347.5When sending a specifically crafted non-UTF-8 string as select-asn query parameter to the /api/v1/origins endpoint, Routinator crashes. Th CVE-2026-492357.5When Routinator encounters a file via RRDP using a specifically crafted Document Type Definition, Routinator crashes.CVE-2026-492377.8An issue was discovered in Canonical Multipass for macOS before version 1.16.3 due to an incomplete fix for CVE-2025-5199. While the patch i CVE-2026-492388.4An issue was discovered in Canonical Multipass before version 1.16.3. The host-side SFTP server component (sshfs_server), which executes wit CVE-2026-49248.2Improper authentication in the two-factor authentication (2FA) feature in Devolutions Server 2026.1.11 and earlier allows a remote attacke CVE-2026-492418.8The Angular Language Service VS Code Extension provides a rich editing experience for Angular templates. Prior to 21.2.4, the client-side An CVE-2026-492439.6Webmin is a web-based system administration tool for Unix-like servers. Prior to version 2.650, Webmin users who click on a malicious link t