@actual-app/sync-server's missing authorization on GET /secret/:name allows non-admin OpenID users to enumerate admin-configured bank-sync secrets
Moderate severity
GitHub Reviewed
Published
Jun 12, 2026
in
actualbudget/actual
•
Updated Jun 22, 2026
Give feedback on Dependabot alerts