CVE-2026-27638mediumCWE-862

CVE-2026-27638: medium-severity vulnerability in actualbudget actual

ActualBudget missing authorization in sync endpoints allows cross-user budget file access in multi-user mode

Published · Updated

Follow this CVE+ Monitor actual+ Monitor @actual-app/sync-server

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.7epss 0.3%
Actual is a local-first personal finance tool. Prior to version 26.2.1, in multi-user mode (OpenID), the sync API endpoints (`/sync/*`) don't verify that the authenticated user owns or has access to the file being operated on. Any authenticated user can read, modify, and overwrite any other user's budget files by providing their file ID. Version 26.2.1 patches the issue.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P
Affected products
actualbudget · actual
Related CVEs — actualbudget actual

In the same product, most dangerous first.

CVE-2026-33318HIGHActual has Privilege Escalation via 'change-password' Endpoint on OpenID-Migrated ServersEPSS 0.5%CVE-2026-27584CRITICALActualBudget server is Missing Authentication for SimpleFIN and Pluggy AI bank sync endpointsEPSS 0.4%CVE-2026-42604MEDIUMActual has an OpenID `client_secret` Disclosure via Broken Authorization Guard in `/openid/config`EPSS 0.4%CVE-2026-49229HIGHActual: Disabled OpenID users keep access through existing session tokensEPSS 0.3%CVE-2026-50007HIGHActual: Shared users can perform owner-only file management actionsEPSS 0.3%CVE-2026-43872MEDIUMactual-server has a path traversal vulnerabilityEPSS 0.3%