actualbudget vulnerabilities

Newest CVEs

• CVE-2026-57449

  Actual Sync Server: CORS Proxy GitHub API Allowlist Prefix Bypass Leaks Private Repositories Through the Server GitHub Token

  actualbudget · actual

  High7.1
• CVE-2026-49229

  Actual: Disabled OpenID users keep access through existing session tokens

  actualbudget · actual

  High8.3
• CVE-2026-50179

  Actual: CSV Formula Injection in Transaction Export via Imported Payee/Notes Fields

  actualbudget · actual

  Medium4.2
• CVE-2026-46700

  Actual: Missing authorization on GET /secret/:name allows non-admin OpenID users to enumerate admin-configured bank-sync secrets

  actualbudget · actual

  Medium4.3
• CVE-2026-46672

  Actual: CSV Formula Injection in `@actual-app/cli` `--format csv` Output via Custom `escapeCsv` Helper

  actualbudget · actual

  Medium4.6
• CVE-2026-50007

  Actual: Shared users can perform owner-only file management actions

  actualbudget · actual

  High7.2
• CVE-2026-43872

  actual-server has a path traversal vulnerability

  actualbudget · actual

  Medium5.3
• CVE-2026-42890

  actual Allows Electron to Run As Node

  actualbudget · actual

  Medium4.8
• CVE-2026-42604

  Actual has an OpenID `client_secret` Disclosure via Broken Authorization Guard in `/openid/config`

  actualbudget · actual

  Medium6.9
• CVE-2026-33318

  Actual has Privilege Escalation via 'change-password' Endpoint on OpenID-Migrated Servers

  actualbudget · actual

  High8.8