Actual is a local-first personal finance app. Prior to 26.6.0, in OpenID multi-user mode, disabling a user only blocks future OpenID login for that identity, wh…

CVE-2026-49229 affects Actual, a local-first personal finance application, in versions prior to 26.6.0. In OpenID multi-user mode, disabling a user account only prevents future OpenID logins but does not invalidate existing session tokens. The session validation logic checks only whether a token row exists and has not expired, without verifying whether the associated user account is still enabled. This flaw allows a disabled user to continue accessing authenticated server endpoints using their still-valid session tokens. The vulnerability represents a broken access control issue in the identity and session management subsystem. It is fixed in version 26.6.0, which introduces a user-enabled status check during session validation. The fix is documented in a GitHub commit and an official security advisory.