Skip to contentActualbudget Actual vulnerabilities
- actualbudget actualActual Sync Server: CORS Proxy GitHub API Allowlist Prefix Bypass Leaks Private Repositories Through the Server GitHub TokenCVE-2026-57449Fix available7.1 High
- actualbudget actualActual: Shared users can perform owner-only file management actionsCVE-2026-500077.2 High
- actualbudget actualActual: CSV Formula Injection in Transaction Export via Imported Payee/Notes FieldsCVE-2026-50179Fix available4.2 Medium
- actualbudget actualActual: Disabled OpenID users keep access through existing session tokensCVE-2026-49229Fix available8.3 High
- actualbudget actualActual: Missing authorization on GET /secret/:name allows non-admin OpenID users to enumerate admin-configured bank-sync secretsCVE-2026-46700Fix available4.3 Medium
- actualbudget actualActual: CSV Formula Injection in `@actual-app/cli` `--format csv` Output via Custom `escapeCsv` HelperCVE-2026-46672Fix available4.6 Medium
- actualbudget actualactual-server has a path traversal vulnerabilityCVE-2026-438725.3 Medium
- actualbudget actualActual has an OpenID `client_secret` Disclosure via Broken Authorization Guard in `/openid/config`CVE-2026-426046.9 Medium
- actualbudget actualactual Allows Electron to Run As NodeCVE-2026-42890Fix available4.8 Medium
- actualbudget actualActual has Privilege Escalation via 'change-password' Endpoint on OpenID-Migrated ServersCVE-2026-33318Fix available8.8 High
- actual sync server, actualbudget actual +1 moreActual Sync Server 26.2.1 - Authenticated Path TraversalCVE-2026-3089Fix available5.3 Medium
- actualbudget actualActualBudget missing authorization in sync endpoints allows cross-user budget file access in multi-user modeCVE-2026-27638Fix available5.7 Medium
- actualbudget actualActualBudget server is Missing Authentication for SimpleFIN and Pluggy AI bank sync endpointsCVE-2026-27584Fix available9.2 Critical