CVE-2026-33318
Actual has Privilege Escalation via 'change-password' Endpoint on OpenID-Migrated Servers
Description
Actual is a local-first personal finance tool. Prior to version 26.4.0, any authenticated user (including `BASIC` role) can escalate to `ADMIN` on servers migrated from password authentication to OpenID Connect. Three weaknesses combine: `POST /account/change-password` has no authorization check, allowing any session to overwrite the password hash; the inactive password `auth` row is never removed on migration; and the login endpoint accepts a client-supplied `loginMethod` that bypasses the server's active auth configuration. Together these allow an attacker to set a known password and authenticate as the anonymous admin account created during the multiuser migration. The three weaknesses form a single, sequential exploit chain — none produces privilege escalation on its own. Missing authorization on POST /change-password allows overwriting a password hash, but only matters if there is an orphaned row to target. Orphaned password row persisting after migration provides the target row, but is harmless without the ability to authenticate using it. Client-controlled loginMethod: "password" allows forcing password-based auth, but is useless without a known hash established by step 1. All three must be chained in sequence to achieve the impact. No single weakness independently results in privilege escalation. The single root cause is the missing authorization check on /change-password; the other two are preconditions that make it exploitable. Version 26.4.0 contains a fix.
INFO
Published Date :
April 24, 2026, 3:16 a.m.
Last Modified :
Oct. 26, 2026, 9:10 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | HIGH | [email protected] |
Solution
- Update Actual to version 26.4.0 or later.
- Review authentication and authorization configurations.
- Remove inactive password authentication rows.
- Ensure login methods enforce active configurations.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-33318.
| URL | Resource |
|---|---|
| https://actualbudget.org/blog/release-26.4.0 | Release Notes |
| https://github.com/actualbudget/actual/security/advisories/GHSA-prp4-2f49-fcgp | Exploit Mitigation Vendor Advisory |
| https://github.com/actualbudget/actual/security/advisories/GHSA-prp4-2f49-fcgp | Exploit Mitigation Vendor Advisory |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-33318 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-33318
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-33318 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-33318 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 26, 2026
Action Type Old Value New Value Added Translation Title: actual de actualbudget, Description: Actual es una herramienta de finanzas personales local-first. Antes de la versión 26.4.0, cualquier usuario autenticado (incluido el rol ’BASIC’) puede escalar a ’ADMIN’ en servidores migrados de la autenticación por contraseña a OpenID Connect. Se combinan tres debilidades: ’POST /account/change-password’ no tiene verificación de autorización, lo que permite a cualquier sesión sobrescribir el hash de la contraseña; la fila ’auth’ de contraseña inactiva nunca se elimina durante la migración; y el endpoint de inicio de sesión acepta un ’loginMethod’ proporcionado por el cliente que omite la configuración de autenticación activa del servidor. Juntas, estas permiten a un atacante establecer una contraseña conocida y autenticarse como la cuenta de administrador anónima creada durante la migración multiusuario. Las tres debilidades forman una única cadena de exploit secuencial - ninguna produce escalada de privilegios por sí misma. La falta de autorización en POST /change-password permite sobrescribir un hash de contraseña, pero solo importa si hay una fila huérfana a la que apuntar. La fila de contraseña huérfana que persiste después de la migración proporciona la fila objetivo, pero es inofensiva sin la capacidad de autenticarse usándola. El ’loginMethod’: ’password’ controlado por el cliente permite forzar la autenticación basada en contraseña, pero es inútil sin un hash conocido establecido en el paso 1. Las tres deben encadenarse en secuencia para lograr el impacto. Ninguna debilidad individual resulta independientemente en escalada de privilegios. La única causa raíz es la falta de verificación de autorización en /change-password; las otras dos son precondiciones que lo hacen explotable. La versión 26.4.0 contiene una corrección. -
CVE Modified by [email protected]
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'actualbudget', 'product': 'actual', 'versions': [{'status': 'affected', 'version': '< 26.4.0'}]}] -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 17, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-33318', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'poc'}, {'automatable': 'no'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-04-25T01:43:46.313187Z'} -
Initial Analysis by [email protected]
Apr. 27, 2026
Action Type Old Value New Value Added CPE Configuration OR *cpe:2.3:a:actualbudget:actual:*:*:*:*:*:node.js:*:* versions up to (excluding) 26.4.0 Added Reference Type GitHub, Inc.: https://actualbudget.org/blog/release-26.4.0 Types: Release Notes Added Reference Type CISA-ADP: https://github.com/actualbudget/actual/security/advisories/GHSA-prp4-2f49-fcgp Types: Exploit, Mitigation, Vendor Advisory Added Reference Type GitHub, Inc.: https://github.com/actualbudget/actual/security/advisories/GHSA-prp4-2f49-fcgp Types: Exploit, Mitigation, Vendor Advisory -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Apr. 25, 2026
Action Type Old Value New Value Added Reference https://github.com/actualbudget/actual/security/advisories/GHSA-prp4-2f49-fcgp -
New CVE Received by [email protected]
Apr. 24, 2026
Action Type Old Value New Value Added Description Actual is a local-first personal finance tool. Prior to version 26.4.0, any authenticated user (including `BASIC` role) can escalate to `ADMIN` on servers migrated from password authentication to OpenID Connect. Three weaknesses combine: `POST /account/change-password` has no authorization check, allowing any session to overwrite the password hash; the inactive password `auth` row is never removed on migration; and the login endpoint accepts a client-supplied `loginMethod` that bypasses the server's active auth configuration. Together these allow an attacker to set a known password and authenticate as the anonymous admin account created during the multiuser migration. The three weaknesses form a single, sequential exploit chain — none produces privilege escalation on its own. Missing authorization on POST /change-password allows overwriting a password hash, but only matters if there is an orphaned row to target. Orphaned password row persisting after migration provides the target row, but is harmless without the ability to authenticate using it. Client-controlled loginMethod: "password" allows forcing password-based auth, but is useless without a known hash established by step 1. All three must be chained in sequence to achieve the impact. No single weakness independently results in privilege escalation. The single root cause is the missing authorization check on /change-password; the other two are preconditions that make it exploitable. Version 26.4.0 contains a fix. Added CVSS V3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Added CWE CWE-284 Added CWE CWE-862 Added Reference https://actualbudget.org/blog/release-26.4.0 Added Reference https://github.com/actualbudget/actual/security/advisories/GHSA-prp4-2f49-fcgp