CVE-2026-50007

unknowncovered by 1 sourcefirst seen 2026-07-07

Actual is an open-source personal finance application. Prior to 26.7.0, a missing authorization issue allows a shared user with user_access on a budget file to perform owner-only file management actions. A non-owner shared user can call file-management endpoints intended for higher-privilege users, including /delete-user-file, /reset-user-file, and /user-create-key, because requireFileAccess treats ordinary shared access as sufficient for file-management operations that should be restricted to the file owner or an administrator. This issue is fixed in version 26.7.0.

⚡ Watch CVE-2026-50007

Get an email if CVE-2026-50007 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Low exploitation risk0.25% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 16% of all EPSS-scored CVEs.

Advisory coverage (1)

unknownCVE-2026-50007: Actual is an open-source personal finance application. Prior to 26.7.0, a missing authorizatio…nvd · 2026-07-07

External references

NVD record for CVE-2026-50007

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-50007 status](https://www.csirts.com/badge/CVE-2026-50007)](https://www.csirts.com/cve/CVE-2026-50007)