Skip to content
Actualbudget vulnerabilities
Newest
-
actualbudget actual
Actual Sync Server: CORS Proxy GitHub API Allowlist Prefix Bypass Leaks Private Repositories Through the Server GitHub Token
CVE-2026-57449
Fix available
7.1 High
-
actualbudget actual
Actual: Shared users can perform owner-only file management actions
CVE-2026-50007
7.2 High
-
actualbudget actual
Actual: CSV Formula Injection in Transaction Export via Imported Payee/Notes Fields
CVE-2026-50179
Fix available
4.2 Medium
-
actualbudget actual
Actual: Disabled OpenID users keep access through existing session tokens
CVE-2026-49229
Fix available
8.3 High
-
actualbudget actual
Actual: Missing authorization on GET /secret/:name allows non-admin OpenID users to enumerate admin-configured bank-sync secrets
CVE-2026-46700
Fix available
4.3 Medium
-
actualbudget actual
Actual: CSV Formula Injection in `@actual-app/cli` `--format csv` Output via Custom `escapeCsv` Helper
CVE-2026-46672
Fix available
4.6 Medium
-
actualbudget actual
actual-server has a path traversal vulnerability
CVE-2026-43872
5.3 Medium
-
actualbudget actual
Actual has an OpenID `client_secret` Disclosure via Broken Authorization Guard in `/openid/config`
CVE-2026-42604
6.9 Medium
-
actualbudget actual
actual Allows Electron to Run As Node
CVE-2026-42890
Fix available
4.8 Medium
-
actualbudget actual
Actual has Privilege Escalation via 'change-password' Endpoint on OpenID-Migrated Servers
CVE-2026-33318
Fix available
8.8 High
-
actual sync server, actualbudget actual +1 more
Actual Sync Server 26.2.1 - Authenticated Path Traversal
CVE-2026-3089
Fix available
5.3 Medium
-
actualbudget actual
ActualBudget missing authorization in sync endpoints allows cross-user budget file access in multi-user mode
CVE-2026-27638
Fix available
5.7 Medium
-
actualbudget actual
ActualBudget server is Missing Authentication for SimpleFIN and Pluggy AI bank sync endpoints
CVE-2026-27584
Fix available
9.2 Critical