@actual-app/sync-server vulnerabilities (npm)
8 vulnerabilities.
-
@actual-app/sync-servernpm Actual Sync Server: CORS Proxy GitHub API Allowlist Prefix Bypass Leaks Private Repositories Through the Server GitHub Token 7.1 High -
@actual-app/sync-servernpm Actual: Disabled OpenID users keep access through existing session tokens 8.3 High -
@actual-app/sync-servernpm Actual: Missing authorization on GET /secret/:name allows non-admin OpenID users to enumerate admin-configured bank-sync secrets 4.3 Medium -
@actual-app/sync-servernpm Actual has Privilege Escalation via 'change-password' Endpoint on OpenID-Migrated Servers 8.8 High -
@actual-app/sync-servernpm Actual Sync Server 26.2.1 - Authenticated Path Traversal 5.3 Medium -
@actual-app/sync-servernpm ActualBudget missing authorization in sync endpoints allows cross-user budget file access in multi-user mode 5.7 Medium -
@actual-app/sync-servernpm ActualBudget server is Missing Authentication for SimpleFIN and Pluggy AI bank sync endpoints 9.2 Critical -
@actual-app/sync-servernpm Actual Sync-server Gocardless service is logging sensitive data including bearer tokens and account numbers 4.2 Medium