GHSA-prp4-2f49-fcgp
High · 8.8CVSS
8.8
EPSS
—
Published
Apr 23, 2026
CISA due date
—
The record
Actual has Privilege Escalation via 'change-password' Endpoint on OpenID-Migrated Servers
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @actual-app/sync-server | 0 | 26.4.0 |
Related vulnerabilities
- CVE-2026-33318 Actual is a local-first personal finance tool. Same vulnerability
- GHSA-27vg-33gh-4hwg Actual Sync Server has an Authenticated Path Traversal Also affects @actual-app/sync-server
- CVE-2026-3089 Actual Sync Server allows authenticated users to upload files through POST… Also affects @actual-app/sync-server
- GHSA-qmjj-p7m9-wjrv @actual-app/sync-server: Missing authorization in sync endpoints allows cross-user budget… Also affects @actual-app/sync-server
- CVE-2026-27638 Actual is a local-first personal finance tool. Also affects @actual-app/sync-server
- GHSA-m2cq-xjgm-f668 ActualBudget server is Missing Authentication for SimpleFIN and Pluggy AI bank sync… Also affects @actual-app/sync-server
- CVE-2026-27584 Actual is a local-first personal finance tool. Also affects @actual-app/sync-server
- CVE-2026-114574 A security vulnerability has been detected in massCodeIO massCode 5.10. CWE-284