ActualBudget missing authorization in sync endpoints allows cross-user budget file access in multi-user mode
Priority HIGH 65CWE-862Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-862.
Summary
Actual is a local-first personal finance tool. Prior to version 26.2.1, in multi-user mode (OpenID), the sync API endpoints (`/sync/*`) don't verify that the authenticated user owns or has access to the file being operated on. Any authenticated user can read, modify, and overwrite any other user's budget files by providing their file ID. Version 26.2.1 patches the issue.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00343 27th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed actual (actualbudget): 26.2.1@actual-app/sync-server (npm): 26.2.1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| actualbudget | actual | before 26.2.1 | 26.2.1 | Patch available | CNA |
| — | @actual-app/sync-server (npm) | before 26.2.1 | 26.2.1 | Patch available | GHSA-qmjj-p7m9-wjrv |
- actual Vendoractualbudget Affected before 26.2.1 Fixed in 26.2.1 Patch available CNA
- @actual-app/sync-server (npm) Vendor— Affected before 26.2.1 Fixed in 26.2.1 Patch available GHSA-qmjj-p7m9-wjrv
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:actualbudget:actual:*:*:*:*:*:node.js:*:* | before 26.2.1 | Vulnerable | actualbudget |
- cpe:2.3:a:actualbudget:actual:*:*:*:*:*:node.js:*:* Versions before 26.2.1 Vulnerable ·actualbudget
Remediation
- Fix · CNA actual (actualbudget) Fixed in 26.2.1
- Fix · GHSA-qmjj-p7m9-wjrv @actual-app/sync-server (npm) Fixed in 26.2.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-27638
- 2026-10-03 Alias added: GHSA-qmjj-p7m9-wjrv
References
More actualbudget Actual vulnerabilities
- TI-2026-21972 ActualBudget server is Missing Authentication for SimpleFIN and Pluggy AI bank sync endpoints CVSS 4.0CRITICAL 9.2
- TI-2026-25729 Actual has Privilege Escalation via 'change-password' Endpoint on OpenID-Migrated Servers CVSS 3.1HIGH 8.8
- TI-2026-02669 Actual Sync Server 26.2.1 - Authenticated Path Traversal CVSS 4.0MEDIUM 5.3
Sources
- CVE-2026-27638 · CVE Program
- CVE-2026-27638 · NVD
- FIRST EPSS
- GHSA-qmjj-p7m9-wjrv · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences