actualbudget actual vulnerabilities

13 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 13 published in the last 12 months.

Latest actualbudget actual vulnerabilities

CVE-2026-57449 — Actual Sync Server: CORS Proxy GitHub API Allowlist Prefix Bypass Leaks Private Repositories Through the Server GitHub Token (CVSS 7.1)
CVE-2026-50179 — Actual: CSV Formula Injection in Transaction Export via Imported Payee/Notes Fields (CVSS 4.2)
CVE-2026-49229 — Actual: Disabled OpenID users keep access through existing session tokens (CVSS 8.3)
CVE-2026-50007 — Actual: Shared users can perform owner-only file management actions (CVSS 7.2)
CVE-2026-46700 — Actual: Missing authorization on GET /secret/:name allows non-admin OpenID users to enumerate admin-configured bank-sync secrets (CVSS 4.3)
CVE-2026-46672 — Actual: CSV Formula Injection in `@actual-app/cli` `--format csv` Output via Custom `escapeCsv` Helper (CVSS 4.6)
CVE-2026-43872 — actual-server has a path traversal vulnerability (CVSS 5.3)
CVE-2026-42890 — actual Allows Electron to Run As Node (CVSS 4.8)
CVE-2026-42604 — Actual has an OpenID `client_secret` Disclosure via Broken Authorization Guard in `/openid/config` (CVSS 6.9)
CVE-2026-33318 — Actual has Privilege Escalation via 'change-password' Endpoint on OpenID-Migrated Servers (CVSS 8.8)
CVE-2026-3089 — Actual Sync Server 26.2.1 - Authenticated Path Traversal (CVSS 6.5)
CVE-2026-27638 — ActualBudget missing authorization in sync endpoints allows cross-user budget file access in multi-user mode (CVSS 7.1)
CVE-2026-27584 — ActualBudget server is Missing Authentication for SimpleFIN and Pluggy AI bank sync endpoints (CVSS 7.5)