Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @actual-app/sync-server | npm | <= 26.5.2 | 26.6.0 |
Miggo AIRoot Cause AnalysisThe vulnerability allows a disabled user to maintain access to the application using an existing session token. The root cause is in the getSession function located in packages/sync-server/src/account-db.js. The original implementation of this function only checked for the existence of a valid token, without verifying if the user associated with that token was still enabled in the system.
The patch, found in commit c8cb8a223a4faf1c2e1dcb0795a79a93f7b19e80, addresses this by modifying the SQL query within getSession. The updated query now performs a JOIN with the users table to check that users.enabled = 1, ensuring that sessions are only considered valid for enabled users.
Additionally, the same commit introduced further mitigations in packages/sync-server/src/services/user-service.ts. The updateUserWithRole and deleteUser functions were updated to proactively delete all sessions belonging to a user when they are disabled or deleted. This acts as a secondary defense by immediately revoking all sessions upon a change in user status.
During exploitation, a call to an authenticated endpoint would trigger middleware which in turn calls validateSession and then the vulnerable getSession function. Therefore, getSession is the key vulnerable function that would appear in a runtime profile.
getSessionpackages/sync-server/src/account-db.js