Skip to content
OpenAdvisories

Package · npm

@actual-app/sync-server

8 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.1
    CVE-2026-57449

    Actual Sync Server: CORS Proxy GitHub API Allowlist Prefix Bypass Leaks Private Repositories Through the Server GitHub Token

    Actual is a local-first personal finance tool. Prior to 26.7.0, Actual Sync Server's CORS proxy is intended to let authenticated users fetch resources only from repositories listed in the official plugin allowlist. When `ACTUAL_GITHUB_TOKEN` is configured, th…

    actualbudget actual @actual-app/sync-server npm
  • High 8.3
    CVE-2026-49229

    Actual: Disabled OpenID users keep access through existing session tokens

    Actual is a local-first personal finance app. Prior to 26.6.0, in OpenID multi-user mode, disabling a user only blocks future OpenID login for that identity, while existing Actual session tokens for the disabled user remain valid. The shared session validatio…

    actualbudget actual @actual-app/sync-server npm
  • High 8.8
    CVE-2026-33318

    Actual has Privilege Escalation via 'change-password' Endpoint on OpenID-Migrated Servers

    Actual is a local-first personal finance tool. Prior to version 26.4.0, any authenticated user (including `BASIC` role) can escalate to `ADMIN` on servers migrated from password authentication to OpenID Connect. Three weaknesses combine: `POST /account/change…

    actualbudget actual @actual-app/sync-server npm