Read the docs
TI-2026-21972 Aliases CVE-2026-27584GHSA-m2cq-xjgm-f668

ActualBudget server is Missing Authentication for SimpleFIN and Pluggy AI bank sync endpoints

Priority HIGH 79CWE-306Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-306.

Summary

Actual is a local-first personal finance tool. Prior to version 26.2.1, missing authentication middleware in the ActualBudget server component allows any unauthenticated user to query the SimpleFIN and Pluggy.ai integration endpoints and read sensitive bank account balance and transaction information. This vulnerability allows an unauthenticated attacker to read the bank account balance and transaction history of ActualBudget users. This vulnerability impacts all ActualBudget Server users with the SimpleFIN or Pluggy.ai integrations configured. The ActualBudget Server instance must be reachable over the network. Version 26.2.1 patches the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0045 39th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed actual (actualbudget): 26.2.1@actual-app/sync-server (npm): 26.2.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
actualbudgetactualbefore 26.2.126.2.1Patch availableCNA
—@actual-app/sync-server (npm)before 26.2.126.2.1Patch availableGHSA-m2cq-xjgm-f668
  • actual Vendoractualbudget Affected before 26.2.1 Fixed in 26.2.1 Patch available CNA
  • @actual-app/sync-server (npm) Vendor— Affected before 26.2.1 Fixed in 26.2.1 Patch available GHSA-m2cq-xjgm-f668

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:actualbudget:actual:*:*:*:*:*:node.js:*:*before 26.2.1Vulnerableactualbudget
  • cpe:2.3:a:actualbudget:actual:*:*:*:*:*:node.js:*:* Versions before 26.2.1 Vulnerable ·actualbudget

Remediation

  • Fix · CNA actual (actualbudget) Fixed in 26.2.1
  • Fix · GHSA-m2cq-xjgm-f668 @actual-app/sync-server (npm) Fixed in 26.2.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-27584
  2. 2026-10-03 Alias added: GHSA-m2cq-xjgm-f668

References

Exploit 1

Patch 1

Advisory 1

Other 1

  • TI-2026-25729 Actual has Privilege Escalation via 'change-password' Endpoint on OpenID-Migrated Servers CVSS 3.1HIGH 8.8
  • TI-2026-22020 ActualBudget missing authorization in sync endpoints allows cross-user budget file access in multi-user mode CVSS 4.0MEDIUM 5.7
  • TI-2026-02669 Actual Sync Server 26.2.1 - Authenticated Path Traversal CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences