@actual-app/sync-server: GET /secret/:name missing admin check
The GET /secret/:name endpoint does not verify the caller is an admin, allowing any authenticated non-admin user in OpenID multi-user deployments to probe the s
What changed
The GET /secret/:name endpoint does not verify the caller is an admin, allowing any authenticated non-admin user in OpenID multi-user deployments to probe the secrets store and determine which admin-managed bank-sync integrations are configured (existence only).
Who it affects
All deployments using OpenID multi-user mode with BASIC users; any authenticated non-admin user can enumerate secret names like gocardless_secretId, simplefin_accessKey, pluggyai_clientSecret, etc.
What to do today
Apply the recommended fix to add an admin check on the GET /secret/:name endpoint, mirroring the POST handler's authorization logic.