Actual Finance Tool: Local Admin Escalation via OIDC Migration Flaw

The National Vulnerability Database has disclosed CVE-2026-33318, a high-severity privilege escalation vulnerability impacting Actual, a local-first personal finance tool. Prior to version 26.4.0, any authenticated user, including those with a BASIC role, could escalate to ADMIN on servers that had migrated from password authentication to OpenID Connect (OIDC). This isn’t a simple oversight; it’s a chain of three distinct weaknesses that attackers can exploit sequentially.

The exploit chain hinges on a missing authorization check on POST /account/change-password, which allows any session to overwrite a password hash. This is combined with the fact that an inactive password authentication row isn’t removed post-migration, providing a target. Finally, the login endpoint accepts a client-supplied loginMethod of “password”, bypassing the server’s active OIDC configuration. An attacker can set a known password for an orphaned admin account and then force password-based authentication to log in as an administrator. Each weakness alone is harmless, but together they grant full administrative control.

This is a critical flaw for organizations using Actual with OIDC. The National Vulnerability Database confirms that version 26.4.0 contains the necessary fix. Defenders must prioritize patching to mitigate this clear path to local administrator privileges, which could lead to complete compromise of sensitive financial data.