actualbudget

Products

Exploited and recent CVEs

• CVE-2026-57449 High 7.1 Actual Sync Server: CORS Proxy GitHub API Allowlist Prefix Bypass Leaks Private Repositories Through the Server GitHub Token 0.3%
• CVE-2026-49229 High 8.3 Actual: Disabled OpenID users keep access through existing session tokens 0.3%
• CVE-2026-50179 Medium 4.2 Actual: CSV Formula Injection in Transaction Export via Imported Payee/Notes Fields 0.3%
• CVE-2026-46700 Medium 4.3 Actual: Missing authorization on GET /secret/:name allows non-admin OpenID users to enumerate admin-configured bank-sync secrets 0.3%
• CVE-2026-46672 Medium 4.6 Actual: CSV Formula Injection in `@actual-app/cli` `--format csv` Output via Custom `escapeCsv` Helper 0.2%
• CVE-2026-50007 High 7.2 Actual: Shared users can perform owner-only file management actions 0.3%
• CVE-2026-43872 Medium 5.3 actual-server has a path traversal vulnerability 0.3%
• CVE-2026-42890 Medium 4.8 actual Allows Electron to Run As Node 0.1%
• CVE-2026-42604 Medium 6.9 Actual has an OpenID `client_secret` Disclosure via Broken Authorization Guard in `/openid/config` 0.4%
• CVE-2026-33318 High 8.8 Actual has Privilege Escalation via 'change-password' Endpoint on OpenID-Migrated Servers 0.5%
• CVE-2026-27638 Medium 5.7 ActualBudget missing authorization in sync endpoints allows cross-user budget file access in multi-user mode 0.3%
• CVE-2026-27584 Critical 9.2 ActualBudget server is Missing Authentication for SimpleFIN and Pluggy AI bank sync endpoints 0.4%