Product by Actual
Actual Sync Server
13 known vulnerabilities in Actual Sync Server (Actual), 0 of them actively exploited (CISA KEV).
Key figures
13
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
1
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2026-33318 | Actual has Privilege Escalation via 'change-password' Endpoint on OpenID-Migrated Servers | 8.8 | |
| Critical | CVE-2026-27584 | ActualBudget server is Missing Authentication for SimpleFIN and Pluggy AI bank sync endpoints | 7.5 | |
| High | CVE-2026-57449 | Actual: Exposure of Sensitive Information to an Unauthorized Actor | — | |
| High | CVE-2026-49229 | Actual: Disabled OpenID users keep access through existing session tokens | 8.3 | |
| Medium | CVE-2026-42604 | Actual has an OpenID `client_secret` Disclosure via Broken Authorization Guard in `/openid/config` | — | |
| High | CVE-2026-50007 | Actual: Shared users can perform owner-only file management actions | — | |
| Medium | CVE-2026-3089 | Actual Sync Server 26.2.1 - Authenticated Path Traversal | 6.5 | |
| High | CVE-2026-27638 | Actual Budget Actual: Missing Authorization | 7.1 | |
| Medium | CVE-2026-43872 | actual-server has a path traversal vulnerability | — | |
| Medium | CVE-2026-50179 | Actual: CSV Formula Injection in Transaction Export via Imported Payee/Notes Fields | 4.2 | |
| Medium | CVE-2026-46700 | Actual Sync Server: Improper Authorization | 4.3 | |
| Medium | CVE-2026-46672 | Actual Sync Server: Improper Neutralization of Formula Elements in a CSV File | 4.6 | |
| Medium | CVE-2026-42890 | actual Allows Electron to Run As Node | — |