Skip to main content
cve.nowby Sazabi
← npm
npmPackage

@actual-app/sync-server

7 known vulnerabilities (1 critical, 3 high, 3 medium), with the versions each affects and the releases that fix them.

Latest release
26.11.0 (Nov 2, 2026): no advisory affects it
Newest unaffected release
26.11.0 (Nov 2, 2026), the latest release
Advisories
7 · 1 critical, 3 high, 3 medium
Weekly downloads
4,259
Dependents
0
Releases
500+ since 25.8.0 (Aug 2, 2025)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-57449
    Affects 25.8.0-nightly.20250710 to 26.7.0-nightly.20260702 (26.7.0 is outside it)
  • CVE-2026-49229
    Affects 25.8.0-nightly.20250710 to 26.6.0-nightly.20260601 (26.6.0 is outside it)
  • CVE-2026-46700
    Affects 25.8.0-nightly.20250710 to 26.6.0-nightly.20260601 (26.6.0 is outside it)
  • CVE-2026-33318
    Affects 25.8.0-nightly.20250710 to 26.4.0-nightly.20260405 (26.4.0 is outside it)
  • CVE-2026-3089
    Affects 25.8.0-nightly.20250710 to 26.3.0-nightly.20260303 (26.3.0 is outside it)
  • CVE-2026-27638
    Affects 25.8.0-nightly.20250710 to 26.2.0 (26.2.1 is outside it)
  • CVE-2026-27584
    Affects 25.8.0-nightly.20250710 to 26.2.0 (26.2.1 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects. Older releases aren't stored, so the earliest spans may start sooner.

Advisories 7

  • Actual Sync Server: CORS Proxy GitHub API Allowlist Prefix Bypass Leaks Private Repositories Through the Server GitHub Token

    Affected: fixed in 26.7.0.

    Fixed in 26.7.0 (released Jul 2, 2026, 85 days before disclosure).

    The latest release, 26.11.0, is not affected.

    10% of @actual-app/sync-server downloads last week were affected versions (450).

  • Actual: Disabled OpenID users keep access through existing session tokens

    Affected: fixed in 26.6.0.

    Fixed in 26.6.0 (released Jun 1, 2026, 36 days before disclosure).

    The latest release, 26.11.0, is not affected.

    9.7% of @actual-app/sync-server downloads last week were affected versions (436).

  • CVE-2026-46700Medium 4.3

    Actual: Missing authorization on GET /secret/:name allows non-admin OpenID users to enumerate admin-configured bank-sync secrets

    Affected: fixed in 26.6.0.

    Fixed in 26.6.0 (released Jun 1, 2026, 36 days before disclosure).

    The latest release, 26.11.0, is not affected.

    9.7% of @actual-app/sync-server downloads last week were affected versions (436).

  • Actual has Privilege Escalation via 'change-password' Endpoint on OpenID-Migrated Servers

    Affected: fixed in 26.4.0.

    Fixed in 26.4.0 (released Apr 5, 2026, 19 days before disclosure).

    The latest release, 26.11.0, is not affected.

    8.3% of @actual-app/sync-server downloads last week were affected versions (375).

  • CVE-2026-3089Medium 5.3

    Actual Sync Server 26.2.1 - Authenticated Path Traversal

    Affected: versions 26.2.1; fixed in 26.3.0.

    Fixed in 26.3.0 (released Mar 3, 2026, 6 days before disclosure).

    The latest release, 26.11.0, is not affected.

    8.1% of @actual-app/sync-server downloads last week were affected versions (362).

  • CVE-2026-27638Medium 5.7

    ActualBudget missing authorization in sync endpoints allows cross-user budget file access in multi-user mode

    Affected: fixed in 26.2.1.

    Fixed in 26.2.1 (released Feb 22, 2026, 4 days before disclosure).

    The latest release, 26.11.0, is not affected.

    7.9% of @actual-app/sync-server downloads last week were affected versions (355).

  • CVE-2026-27584Critical 9.2

    ActualBudget server is Missing Authentication for SimpleFIN and Pluggy AI bank sync endpoints

    Affected: fixed in 26.2.1.

    Fixed in 26.2.1 (released Feb 22, 2026, 2 days before disclosure).

    The latest release, 26.11.0, is not affected.

    7.9% of @actual-app/sync-server downloads last week were affected versions (355).