# @actual-app/sync-server (npm) vulnerabilities 7 known vulnerabilities (1 critical, 3 high, 3 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 26.11.0 (Nov 2, 2026): no advisory affects it - Newest unaffected release: 26.11.0 (Nov 2, 2026), the latest release - Weekly downloads: 4,259 - Dependents: 0 - Releases: 500+ since 25.8.0 (Aug 2, 2025) - Registry: https://www.npmjs.com/package/@actual-app/sync-server - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-57449: 25.8.0-nightly.20250710 to 26.7.0-nightly.20260702 (26.7.0 is outside it) - CVE-2026-49229: 25.8.0-nightly.20250710 to 26.6.0-nightly.20260601 (26.6.0 is outside it) - CVE-2026-46700: 25.8.0-nightly.20250710 to 26.6.0-nightly.20260601 (26.6.0 is outside it) - CVE-2026-33318: 25.8.0-nightly.20250710 to 26.4.0-nightly.20260405 (26.4.0 is outside it) - CVE-2026-3089: 25.8.0-nightly.20250710 to 26.3.0-nightly.20260303 (26.3.0 is outside it) - CVE-2026-27638: 25.8.0-nightly.20250710 to 26.2.0 (26.2.1 is outside it) - CVE-2026-27584: 25.8.0-nightly.20250710 to 26.2.0 (26.2.1 is outside it) Older releases aren't stored, so the earliest spans may start sooner. ## Advisories (7) ### [CVE-2026-57449](https://cve.now/CVE-2026-57449): Actual Sync Server: CORS Proxy GitHub API Allowlist Prefix Bypass Leaks Private Repositories Through the Server GitHub Token - Severity: High 7.1 - Published: Sep 25, 2026 - Affected: fixed in 26.7.0. - Fixed in 26.7.0 (released Jul 2, 2026, 85 days before disclosure). - The latest release, 26.11.0, is not affected. - 10% of @actual-app/sync-server downloads last week were affected versions (450). ### [CVE-2026-49229](https://cve.now/CVE-2026-49229): Actual: Disabled OpenID users keep access through existing session tokens - Severity: High 8.3 - Published: Jul 7, 2026 - Affected: fixed in 26.6.0. - Fixed in 26.6.0 (released Jun 1, 2026, 36 days before disclosure). - The latest release, 26.11.0, is not affected. - 9.7% of @actual-app/sync-server downloads last week were affected versions (436). ### [CVE-2026-46700](https://cve.now/CVE-2026-46700): Actual: Missing authorization on GET /secret/:name allows non-admin OpenID users to enumerate admin-configured bank-sync secrets - Severity: Medium 4.3 - Published: Jul 7, 2026 - Affected: fixed in 26.6.0. - Fixed in 26.6.0 (released Jun 1, 2026, 36 days before disclosure). - The latest release, 26.11.0, is not affected. - 9.7% of @actual-app/sync-server downloads last week were affected versions (436). ### [CVE-2026-33318](https://cve.now/CVE-2026-33318): Actual has Privilege Escalation via 'change-password' Endpoint on OpenID-Migrated Servers - Severity: High 8.8 - Published: Apr 24, 2026 - Affected: fixed in 26.4.0. - Fixed in 26.4.0 (released Apr 5, 2026, 19 days before disclosure). - The latest release, 26.11.0, is not affected. - 8.3% of @actual-app/sync-server downloads last week were affected versions (375). ### [CVE-2026-3089](https://cve.now/CVE-2026-3089): Actual Sync Server 26.2.1 - Authenticated Path Traversal - Severity: Medium 5.3 - Published: Mar 9, 2026 - Affected: versions 26.2.1; fixed in 26.3.0. - Fixed in 26.3.0 (released Mar 3, 2026, 6 days before disclosure). - The latest release, 26.11.0, is not affected. - 8.1% of @actual-app/sync-server downloads last week were affected versions (362). ### [CVE-2026-27638](https://cve.now/CVE-2026-27638): ActualBudget missing authorization in sync endpoints allows cross-user budget file access in multi-user mode - Severity: Medium 5.7 - Published: Feb 26, 2026 - Affected: fixed in 26.2.1. - Fixed in 26.2.1 (released Feb 22, 2026, 4 days before disclosure). - The latest release, 26.11.0, is not affected. - 7.9% of @actual-app/sync-server downloads last week were affected versions (355). ### [CVE-2026-27584](https://cve.now/CVE-2026-27584): ActualBudget server is Missing Authentication for SimpleFIN and Pluggy AI bank sync endpoints - Severity: Critical 9.2 - Published: Feb 24, 2026 - Affected: fixed in 26.2.1. - Fixed in 26.2.1 (released Feb 22, 2026, 2 days before disclosure). - The latest release, 26.11.0, is not affected. - 7.9% of @actual-app/sync-server downloads last week were affected versions (355). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/@actual-app/sync-server Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.