GHSA-m2cq-xjgm-f668
NoneCVSS
—
EPSS
—
Published
Feb 24, 2026
CISA due date
—
The record
ActualBudget server is Missing Authentication for SimpleFIN and Pluggy AI bank sync endpoints
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @actual-app/sync-server | 0 | 26.2.1 |
Related vulnerabilities
- CVE-2026-27584 Actual is a local-first personal finance tool. Same vulnerability
- CVE-2026-33318 Actual is a local-first personal finance tool. Also affects @actual-app/sync-server
- GHSA-prp4-2f49-fcgp Actual has Privilege Escalation via 'change-password' Endpoint on OpenID-Migrated Servers Also affects @actual-app/sync-server
- GHSA-27vg-33gh-4hwg Actual Sync Server has an Authenticated Path Traversal Also affects @actual-app/sync-server
- CVE-2026-3089 Actual Sync Server allows authenticated users to upload files through POST… Also affects @actual-app/sync-server
- GHSA-qmjj-p7m9-wjrv @actual-app/sync-server: Missing authorization in sync endpoints allows cross-user budget… Also affects @actual-app/sync-server
- CVE-2026-27638 Actual is a local-first personal finance tool. Also affects @actual-app/sync-server
- CVE-2026-114636 Traefik v3.7.13 before v3.7.14 contains an access-control bypass in the Kubernetes… CWE-306