Vulnerabilities

TI-2026-25729 CVE-2026-33318 · GHSA-prp4-2f49-fcgp

Actual has Privilege Escalation via 'change-password' Endpoint on OpenID-Migrated Servers

HIGH 73

Actual is a local-first personal finance tool.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00472 Published 2026-04-24 Fixed in 26.4.0 CWE-284

TI-2026-02669 CVE-2026-3089 · GHSA-27vg-33gh-4hwg

MEDIUM 63

Actual Sync Server allows authenticated users to upload files through POST /sync/upload-user-file.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00416 Published 2026-03-09 Fixed in 26.3.0 CWE-22

TI-2026-22020 CVE-2026-27638 · GHSA-qmjj-p7m9-wjrv

HIGH 65

Actual is a local-first personal finance tool.

CVSS 4.0MEDIUM 5.7 Network Low privileges No interaction EPSS 0.00343 Published 2026-02-26 Fixed in 26.2.1 CWE-862

TI-2026-21972 CVE-2026-27584 · GHSA-m2cq-xjgm-f668

HIGH 79

Actual is a local-first personal finance tool.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.0045 Published 2026-02-24 Fixed in 26.2.1 CWE-306