GHSA-qmjj-p7m9-wjrv
NoneCVSS
—
EPSS
—
Published
Feb 27, 2026
CISA due date
—
The record
@actual-app/sync-server: Missing authorization in sync endpoints allows cross-user budget file access in multi-user mode
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @actual-app/sync-server | 0 | 26.2.1 |
Related vulnerabilities
- CVE-2026-27638 Actual is a local-first personal finance tool. Same vulnerability
- CVE-2026-33318 Actual is a local-first personal finance tool. Also affects @actual-app/sync-server
- GHSA-prp4-2f49-fcgp Actual has Privilege Escalation via 'change-password' Endpoint on OpenID-Migrated Servers Also affects @actual-app/sync-server
- GHSA-27vg-33gh-4hwg Actual Sync Server has an Authenticated Path Traversal Also affects @actual-app/sync-server
- CVE-2026-3089 Actual Sync Server allows authenticated users to upload files through POST… Also affects @actual-app/sync-server
- GHSA-m2cq-xjgm-f668 ActualBudget server is Missing Authentication for SimpleFIN and Pluggy AI bank sync… Also affects @actual-app/sync-server
- CVE-2026-27584 Actual is a local-first personal finance tool. Also affects @actual-app/sync-server
- CVE-2026-96391 Missing Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. CWE-862