@actual-app/sync-server (>=25.4.0-alpha.0, <=26.6.0-nightly.20260601) potentially affected by CVE-2026-50179 via @actual-app/web (>=25.3.1, <=26.6.0-nightly.20260601)

@actual-app/web NPM version =25.3.1, =25.4.0-alpha.0, =26.6.0-nightly.20260601 Source cves: CVE-2026-50179 Source advisory: MEND:CVE-2026-50179...

CVE-2026-46700

Actual is a local-first personal finance tool. Prior to 26.6.0, the GET /secret/:name endpoint in @actual-app/sync-server checks only that the caller has a valid session and does not verify the caller is an admin, while the sibling POST /secret/ handler enforces an admin check in OpenID mode. Any...

@actual-app/sync-server (>=26.1.0-nightly.20251204, <=26.6.0-nightly.20260601) potentially affected by CVE-2026-50179 via @actual-app/web (>=26.1.0-nightly.20251204, <=26.6.0-nightly.20260601)

@actual-app/web NPM version =26.1.0-nightly.20251204, =26.1.0-nightly.20251204, =26.6.0-nightly.20260601 Source cves: CVE-2026-50179 Source advisory: OSV:GHSA-XQJM-27PC-RVWM...

@actual-app/sync-server (>=26.1.0-nightly.20251204, <=26.6.0-nightly.20260601) potentially affected by CVE-2026-50179 via @actual-app/web (>=26.1.0-nightly.20251204, <=26.6.0-nightly.20260601)

@actual-app/web NPM version =26.1.0-nightly.20251204, =26.1.0-nightly.20251204, =26.6.0-nightly.20260601 Source cves: CVE-2026-50179 Source advisory: SNYK:JS-ACTUALAPPWEB-17818134...

@actual-app/sync-server (>=26.1.0-nightly.20251204, <=26.6.0-nightly.20260601) potentially affected by CVE-2026-50179 via @actual-app/web (>=26.1.0-nightly.20251204, <=26.6.0-nightly.20260601)

@actual-app/web NPM version =26.1.0-nightly.20251204, =26.1.0-nightly.20251204, =26.6.0-nightly.20260601 Source cves: CVE-2026-50179 Source advisory: GHSA-XQJM-27PC-RVWM...