Vulnerabilities in actualbudget
12 resultsCVE-2026-33318HIGHActual has Privilege Escalation via 'change-password' Endpoint on OpenID-Migrated ServersEPSS 0.5%CVE-2026-27584CRITICALActualBudget server is Missing Authentication for SimpleFIN and Pluggy AI bank sync endpointsEPSS 0.4%CVE-2026-42604MEDIUMActual has an OpenID `client_secret` Disclosure via Broken Authorization Guard in `/openid/config`EPSS 0.4%CVE-2026-27638MEDIUMActualBudget missing authorization in sync endpoints allows cross-user budget file access in multi-user modeEPSS 0.3%CVE-2026-49229HIGHActual: Disabled OpenID users keep access through existing session tokensEPSS 0.3%CVE-2026-50007HIGHActual: Shared users can perform owner-only file management actionsEPSS 0.3%CVE-2026-43872MEDIUMactual-server has a path traversal vulnerabilityEPSS 0.3%CVE-2026-50179MEDIUMActual: CSV Formula Injection in Transaction Export via Imported Payee/Notes FieldsEPSS 0.3%CVE-2026-57449HIGHActual Sync Server: CORS Proxy GitHub API Allowlist Prefix Bypass Leaks Private Repositories Through the Server GitHub TokenEPSS 0.3%CVE-2026-46700MEDIUMActual: Missing authorization on GET /secret/:name allows non-admin OpenID users to enumerate admin-configured bank-sync secretsEPSS 0.3%CVE-2026-46672MEDIUMActual: CSV Formula Injection in `@actual-app/cli` `--format csv` Output via Custom `escapeCsv` HelperEPSS 0.2%CVE-2026-42890MEDIUMactual Allows Electron to Run As NodeEPSS 0.1%