CVE-2026-27638 json
ActualBudget missing authorization in sync endpoints allows cross-user budget file access in multi-user mode
published 2026-02-26 8 mo ago modified 2026-06-17 4 mo ago also GHSA-qmjj-p7m9-wjrv , EUVD-2026-8905
- cvss
- 7.1
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 28%
- public exploits
- 0
- none known
Summary
Actual is a local-first personal finance tool. Prior to version 26.2.1, in multi-user mode (OpenID), the sync API endpoints (`/sync/*`) don't verify that the authenticated user owns or has access to the file being operated on. Any authenticated user can read, modify, and overwrite any other user's budget files by providing their file ID. Version 26.2.1 patches the issue.
Patch / fix
- npm @actual-app/sync-server 26.2.1
- actualbudget actual 26.2.1
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 8 mo ago
Exploit prediction
0.34% chance of exploitation in the next 30 days, higher than 28% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/actualbudget/actual/security/advisories/GHSA-qmjj-p7m9-wjrv referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 5.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P |
| CNA | 4.0 | 5.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 7.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | @actual-app/sync-server | <26.2.1 |
26.2.1 |
Affected products
- actualbudget actual
Classification
- Weakness
-
- CWE-862 Missing Authorization
References
-
github.com
/actualbudget/actual/commit/9966c024cb75f57943193cac8e42f401efed9d08
web, patch
-
github.com
/actualbudget/actual/security/advisories/GHSA-qmjj-p7m9-wjrv
web, exploit, vendor-advisory
-
github.com
/actualbudget/actual/releases/tag/v26.2.1
web, product, release-notes
-
nvd.nist.gov
/vuln/detail/CVE-2026-27638
advisory
-
github.com
/actualbudget/actual
package
Sources
- CVE List CVE-2026-27638
- GitHub Advisory GHSA-qmjj-p7m9-wjrv
- NVD CVE-2026-27638
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.