CVE-2026-27584

The record

Actual is a local-first personal finance tool. Prior to version 26.2.1, missing authentication middleware in the ActualBudget server component allows any unauthenticated user to query the SimpleFIN and Pluggy.ai integration endpoints and read sensitive bank account balance and transaction information. This vulnerability allows an unauthenticated attacker to read the bank account balance and transaction history of ActualBudget users. This vulnerability impacts all ActualBudget Server users with the SimpleFIN or Pluggy.ai integrations configured. The ActualBudget Server instance must be reachable over the network. Version 26.2.1 patches the issue.

Affected packages

Related vulnerabilities

• GHSA-m2cq-xjgm-f668 ActualBudget server is Missing Authentication for SimpleFIN and Pluggy AI bank sync… Same vulnerability
• CVE-2026-33318 Actual is a local-first personal finance tool. Also affects @actual-app/sync-server
• GHSA-prp4-2f49-fcgp Actual has Privilege Escalation via 'change-password' Endpoint on OpenID-Migrated Servers Also affects @actual-app/sync-server
• GHSA-27vg-33gh-4hwg Actual Sync Server has an Authenticated Path Traversal Also affects @actual-app/sync-server
• CVE-2026-3089 Actual Sync Server allows authenticated users to upload files through POST… Also affects @actual-app/sync-server
• GHSA-qmjj-p7m9-wjrv @actual-app/sync-server: Missing authorization in sync endpoints allows cross-user budget… Also affects @actual-app/sync-server
• CVE-2026-27638 Actual is a local-first personal finance tool. Also affects @actual-app/sync-server
• CVE-2026-114636 Traefik v3.7.13 before v3.7.14 contains an access-control bypass in the Kubernetes… CWE-306