Actual is a local-first personal finance tool. Prior to version 26.4.0, any authenticated user (including `BASIC` role) can escalate to `ADMIN` on servers migra…

CVE-2026-33318 affects Actual, a local-first personal finance tool, allowing authenticated users with BASIC role to escalate to ADMIN privileges on servers migrated from password to OpenID Connect authentication. The vulnerability combines three weaknesses: missing authorization on POST /account/change-password endpoint, orphaned password auth rows persisting after migration, and client-controlled loginMethod bypassing server auth configuration. These form a sequential exploit chain allowing attackers to set known passwords and authenticate as anonymous admin accounts. Fixed in version 26.4.0.