Skip to content
OpenAdvisories

Package · npm

@actual-app/sync-server

8 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.2
    CVE-2026-27584

    ActualBudget server is Missing Authentication for SimpleFIN and Pluggy AI bank sync endpoints

    Actual is a local-first personal finance tool. Prior to version 26.2.1, missing authentication middleware in the ActualBudget server component allows any unauthenticated user to query the SimpleFIN and Pluggy.ai integration endpoints and read sensitive bank a…

    actualbudget actual @actual-app/sync-server npm