CVE-2026-33318

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-33318", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-18T21:23:36.677Z", "datePublished": "2026-04-24T02:13:47.200Z", "dateUpdated": "2026-04-25T01:44:08.129Z"}, "containers": {"cna": {"title": "Actual has Privilege Escalation via 'change-password' Endpoint on OpenID-Migrated Servers", "problemTypes": [{"descriptions": [{"cweId": "CWE-284", "lang": "en", "description": "CWE-284: Improper Access Control", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-862", "lang": "en", "description": "CWE-862: Missing Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/actualbudget/actual/security/advisories/GHSA-prp4-2f49-fcgp", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/actualbudget/actual/security/advisories/GHSA-prp4-2f49-fcgp"}, {"name": "https://actualbudget.org/blog/release-26.4.0", "tags": ["x_refsource_MISC"], "url": "https://actualbudget.org/blog/release-26.4.0"}], "affected": [{"vendor": "actualbudget", "product": "actual", "versions": [{"version": "< 26.4.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-24T02:13:47.200Z"}, "descriptions": [{"lang": "en", "value": "Actual is a local-first personal finance tool. Prior to version 26.4.0, any authenticated user (including `BASIC` role) can escalate to `ADMIN` on servers migrated from password authentication to OpenID Connect. Three weaknesses combine: `POST /account/change-password` has no authorization check, allowing any session to overwrite the password hash; the inactive password `auth` row is never removed on migration; and the login endpoint accepts a client-supplied `loginMethod` that bypasses the server's active auth configuration. Together these allow an attacker to set a known password and authenticate as the anonymous admin account created during the multiuser migration. The three weaknesses form a single, sequential exploit chain \u2014 none produces privilege escalation on its own. Missing authorization on POST /change-password allows overwriting a password hash, but only matters if there is an orphaned row to target. Orphaned password row persisting after migration provides the target row, but is harmless without the ability to authenticate using it. Client-controlled loginMethod: \"password\" allows forcing password-based auth, but is useless without a known hash established by step 1. All three must be chained in sequence to achieve the impact. No single weakness independently results in privilege escalation. The single root cause is the missing authorization check on /change-password; the other two are preconditions that make it exploitable. Version 26.4.0 contains a fix."}], "source": {"advisory": "GHSA-prp4-2f49-fcgp", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/actualbudget/actual/security/advisories/GHSA-prp4-2f49-fcgp", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-25T01:43:46.313187Z", "id": "CVE-2026-33318", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-25T01:44:08.129Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-33318", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-25T01:43:46.313187Z"}}}], "references": [{"url": "https://github.com/actualbudget/actual/security/advisories/GHSA-prp4-2f49-fcgp", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-25T01:44:03.808Z"}}], "cna": {"title": "Actual has Privilege Escalation via 'change-password' Endpoint on OpenID-Migrated Servers", "source": {"advisory": "GHSA-prp4-2f49-fcgp", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "actualbudget", "product": "actual", "versions": [{"status": "affected", "version": "< 26.4.0"}]}], "references": [{"url": "https://github.com/actualbudget/actual/security/advisories/GHSA-prp4-2f49-fcgp", "name": "https://github.com/actualbudget/actual/security/advisories/GHSA-prp4-2f49-fcgp", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://actualbudget.org/blog/release-26.4.0", "name": "https://actualbudget.org/blog/release-26.4.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Actual is a local-first personal finance tool. Prior to version 26.4.0, any authenticated user (including `BASIC` role) can escalate to `ADMIN` on servers migrated from password authentication to OpenID Connect. Three weaknesses combine: `POST /account/change-password` has no authorization check, allowing any session to overwrite the password hash; the inactive password `auth` row is never removed on migration; and the login endpoint accepts a client-supplied `loginMethod` that bypasses the server's active auth configuration. Together these allow an attacker to set a known password and authenticate as the anonymous admin account created during the multiuser migration. The three weaknesses form a single, sequential exploit chain \u2014 none produces privilege escalation on its own. Missing authorization on POST /change-password allows overwriting a password hash, but only matters if there is an orphaned row to target. Orphaned password row persisting after migration provides the target row, but is harmless without the ability to authenticate using it. Client-controlled loginMethod: \"password\" allows forcing password-based auth, but is useless without a known hash established by step 1. All three must be chained in sequence to achieve the impact. No single weakness independently results in privilege escalation. The single root cause is the missing authorization check on /change-password; the other two are preconditions that make it exploitable. Version 26.4.0 contains a fix."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284: Improper Access Control"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862: Missing Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-24T02:13:47.200Z"}}}, "cveMetadata": {"cveId": "CVE-2026-33318", "state": "PUBLISHED", "dateUpdated": "2026-04-25T01:44:08.129Z", "dateReserved": "2026-03-18T21:23:36.677Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-24T02:13:47.200Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "actual", "vendor": "actualbudget", "versions": [{"status": "affected", "version": "< 26.4.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:actualbudget:actual:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "5EC7E455-5004-4D86-9FBD-DD88A4C3A1AA", "versionEndExcluding": "26.4.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Actual is a local-first personal finance tool. Prior to version 26.4.0, any authenticated user (including `BASIC` role) can escalate to `ADMIN` on servers migrated from password authentication to OpenID Connect. Three weaknesses combine: `POST /account/change-password` has no authorization check, allowing any session to overwrite the password hash; the inactive password `auth` row is never removed on migration; and the login endpoint accepts a client-supplied `loginMethod` that bypasses the server's active auth configuration. Together these allow an attacker to set a known password and authenticate as the anonymous admin account created during the multiuser migration. The three weaknesses form a single, sequential exploit chain \u2014 none produces privilege escalation on its own. Missing authorization on POST /change-password allows overwriting a password hash, but only matters if there is an orphaned row to target. Orphaned password row persisting after migration provides the target row, but is harmless without the ability to authenticate using it. Client-controlled loginMethod: \"password\" allows forcing password-based auth, but is useless without a known hash established by step 1. All three must be chained in sequence to achieve the impact. No single weakness independently results in privilege escalation. The single root cause is the missing authorization check on /change-password; the other two are preconditions that make it exploitable. Version 26.4.0 contains a fix."}, {"lang": "es", "value": "Actual es una herramienta de finanzas personales local-first. Antes de la versi\u00f3n 26.4.0, cualquier usuario autenticado (incluido el rol \u2019BASIC\u2019) puede escalar a \u2019ADMIN\u2019 en servidores migrados de la autenticaci\u00f3n por contrase\u00f1a a OpenID Connect. Se combinan tres debilidades: \u2019POST /account/change-password\u2019 no tiene verificaci\u00f3n de autorizaci\u00f3n, lo que permite a cualquier sesi\u00f3n sobrescribir el hash de la contrase\u00f1a; la fila \u2019auth\u2019 de contrase\u00f1a inactiva nunca se elimina durante la migraci\u00f3n; y el endpoint de inicio de sesi\u00f3n acepta un \u2019loginMethod\u2019 proporcionado por el cliente que omite la configuraci\u00f3n de autenticaci\u00f3n activa del servidor. Juntas, estas permiten a un atacante establecer una contrase\u00f1a conocida y autenticarse como la cuenta de administrador an\u00f3nima creada durante la migraci\u00f3n multiusuario. Las tres debilidades forman una \u00fanica cadena de exploit secuencial - ninguna produce escalada de privilegios por s\u00ed misma. La falta de autorizaci\u00f3n en POST /change-password permite sobrescribir un hash de contrase\u00f1a, pero solo importa si hay una fila hu\u00e9rfana a la que apuntar. La fila de contrase\u00f1a hu\u00e9rfana que persiste despu\u00e9s de la migraci\u00f3n proporciona la fila objetivo, pero es inofensiva sin la capacidad de autenticarse us\u00e1ndola. El \u2019loginMethod\u2019: \u2019password\u2019 controlado por el cliente permite forzar la autenticaci\u00f3n basada en contrase\u00f1a, pero es in\u00fatil sin un hash conocido establecido en el paso 1. Las tres deben encadenarse en secuencia para lograr el impacto. Ninguna debilidad individual resulta independientemente en escalada de privilegios. La \u00fanica causa ra\u00edz es la falta de verificaci\u00f3n de autorizaci\u00f3n en /change-password; las otras dos son precondiciones que lo hacen explotable. La versi\u00f3n 26.4.0 contiene una correcci\u00f3n."}], "id": "CVE-2026-33318", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33318", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-25T01:43:46.313187Z", "version": "2.0.3"}}]}, "published": "2026-04-24T03:16:11.203", "references": [{"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://actualbudget.org/blog/release-26.4.0"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/actualbudget/actual/security/advisories/GHSA-prp4-2f49-fcgp"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/actualbudget/actual/security/advisories/GHSA-prp4-2f49-fcgp"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}, {"lang": "en", "value": "CWE-862"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,26.4.0)"}}], "enrichment": {"confidence": 90.0, "confidence_source": "inferred", "scores": [{"score": 90.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "actual", "source": "cna", "vendor": "actualbudget"}, "product": "actual", "vendor": "actualbudget"}], "analysis": {"en": {"generated_at": "2026-04-28T14:27:13.461543+00:00", "value": {"mitigation_remediation": ["Upgrade to Actual 26.4.0 or later to apply the vendor-fix.", "Remove any orphaned password rows left over from a migration to OpenID Connect by running the appropriate database cleanup scripts.", "Disable or restrict the POST /account/change-password endpoint to only authorized administrators, ensuring that only users with administrative roles can change passwords.", "Configure the server to enforce OpenID Connect for all authentication requests and disable legacy password\u2011based login methods."], "summary": {"action": "Immediate Patch", "impact": "Privilege Escalation"}, "threat_synthesis": {"affected_systems": "The affected product is Actual from actualbudget. Versions older than 26.4.0 on servers that migrated to OpenID Connect are vulnerable. The vulnerability exists for installations that still retain orphaned password rows after migration to OpenID Connect. No specific operating system or Node.js version is indicated beyond the general dependency on Node.js for the application.", "description_and_impact": "Actual is a local\u2011first personal finance application that, prior to version 26.4.0, allows any authenticated user, including those with a BASIC role, to attain administrative privileges on servers transitioned from password authentication to OpenID Connect. The attacker must first overwrite an orphaned password hash via POST /account/change-password, then use a client\u2011supplied loginMethod to force password authentication against that hash, and finally authenticate as the anonymous admin account created during the migration. The weakest point is the missing authorization check on the /change-password endpoint; the other weaknesses are preconditions that allow the chain to succeed. If all three steps succeed the attacker can modify all data and execute any action as an admin, compromising confidentiality, integrity, and availability of the system.", "risk_and_exploitability": "The CVSS score of 8.8 reflects a high severity impact. The EPSS score is less than 1%, indicating a very low probability of exploitation in the wild, yet the vulnerability has been documented in a public advisory and exists in deployed, unpatched systems. Because the exploitation chain requires sequential steps\u2014overwriting a password hash, forcing a password login, and authenticating as the anonymous admin\u2014the attack vector is likely internal or from a compromised authenticated session. The vulnerability is not listed in the CISA KEV catalog, but the high CVSS rating warrants prompt remediation The lack of an authorization check on /change-password is the root cause and allows an attacker who can reach the endpoint to obtain full administrative control if the preconditions are present."}}}}, "created": "2026-04-27T21:15:05.347916+00:00", "updated": "2026-04-28T14:30:33.769748+00:00", "vendors": ["actualbudget", "actualbudget$PRODUCT$actual"]}