Vulnerabilities

TI-2026-41382 CVE-2026-57449 · GHSA-m62c-5q34-f3cf

Information disclosure in actualbudget actual

MEDIUM 64

Actual is a local-first personal finance tool.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00258 Published 2026-09-25 Fixed in 26.7.0 CWE-200

TI-2026-36430 CVE-2026-49229 · GHSA-cq9c-6w48-qmfg

Actual: Disabled OpenID users keep access through existing session tokens

HIGH 71

Actual is a local-first personal finance app.

CVSS 3.1HIGH 8.3 Network Low privileges No interaction EPSS 0.0032 Published 2026-07-07 Fixed in 26.6.0 CWE-613

TI-2026-36938 CVE-2026-50179 · GHSA-xqjm-27pc-rvwm

Actual: CSV Formula Injection in Transaction Export via Imported Payee/Notes Fields

LOW 19

Actual is a local-first personal finance tool.

CVSS 3.1MEDIUM 4.2 Network No auth User interaction EPSS 0.00286 Published 2026-07-07 Fixed in 26.6.0 CWE-1236

TI-2026-34329 CVE-2026-46700 · GHSA-3f62-qv96-4p78

Improper authorization in actualbudget actual

MEDIUM 53

Actual is a local-first personal finance tool.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00251 Published 2026-07-07 Fixed in 26.6.0 CWE-285

TI-2026-34307 CVE-2026-46672 · GHSA-7gh7-258j-4mpq

Actual: CSV Formula Injection in `@actual-app/cli` `--format csv` Output via Custom `escapeCsv` Helper

MEDIUM 54

Actual is a local-first personal finance app.

CVSS 3.1MEDIUM 4.6 Local Low privileges User interaction EPSS 0.00184 Published 2026-07-07 Fixed in 26.6.0 CWE-1236

TI-2026-36833 CVE-2026-50007

Actual: Shared users can perform owner-only file management actions

HIGH 67

Actual is an open-source personal finance application.

CVSS 4.0HIGH 7.2 Network Low privileges No interaction EPSS 0.00312 Published 2026-07-07 Fixed in 26.7.0 CWE-862

TI-2026-31936 CVE-2026-43872

actual-server has a path traversal vulnerability

LOW 24

Actual is an open-source personal finance application.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00303 Published 2026-06-12 Fixed in 26.5.0 CWE-22

TI-2026-31096 CVE-2026-42890 · GHSA-7rvm-xjpp-63r9

actual Allows Electron to Run As Node

LOW 21

Actual is an open-source personal finance application.

CVSS 4.0MEDIUM 4.8 Local Low privileges No interaction EPSS 0.00126 Published 2026-06-12 Fixed in 26.5.0 CWE-94

TI-2026-30884 CVE-2026-42604

Actual has an OpenID `client_secret` Disclosure via Broken Authorization Guard in `/openid/config`

LOW 33

Actual is a local-first personal finance tool.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.004 Published 2026-06-12 Fixed in 26.5.0 CWE-863

TI-2026-25729 CVE-2026-33318 · GHSA-prp4-2f49-fcgp

Actual has Privilege Escalation via 'change-password' Endpoint on OpenID-Migrated Servers

HIGH 73

Actual is a local-first personal finance tool.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00472 Published 2026-04-24 Fixed in 26.4.0 CWE-284

TI-2026-02669 CVE-2026-3089 · GHSA-27vg-33gh-4hwg

Actual Sync Server 26.2.1 - Authenticated Path Traversal

MEDIUM 63

Actual Sync Server allows authenticated users to upload files through POST /sync/upload-user-file.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00416 Published 2026-03-09 Fixed in 26.3.0 CWE-22

TI-2026-22020 CVE-2026-27638 · GHSA-qmjj-p7m9-wjrv

ActualBudget missing authorization in sync endpoints allows cross-user budget file access in multi-user mode

HIGH 65

Actual is a local-first personal finance tool.

CVSS 4.0MEDIUM 5.7 Network Low privileges No interaction EPSS 0.00343 Published 2026-02-26 Fixed in 26.2.1 CWE-862

TI-2026-21972 CVE-2026-27584 · GHSA-m2cq-xjgm-f668

ActualBudget server is Missing Authentication for SimpleFIN and Pluggy AI bank sync endpoints

HIGH 79

Actual is a local-first personal finance tool.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.0045 Published 2026-02-24 Fixed in 26.2.1 CWE-306

Vulnerabilities

Filters