Actualbudget Actual
12 CVEs affecting Actualbudget Actual. Latest disclosed: 2026-07-07. Critical: 0, High: 4.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-33318 | High | 8.8 | 2026-04-24 | Actual is a local-first personal finance tool. Prior to version 26.4.0, any authenticated user (including `BASIC` role) can escalate to `ADMIN` on servers migr… |
CVE-2026-49229 | High | 8.3 | 2026-07-07 | Actual is a local-first personal finance app. Prior to 26.6.0, in OpenID multi-user mode, disabling a user only blocks future OpenID login for that identity, w… |
CVE-2026-27584 | High | 7.5 | 2026-02-24 | Actual is a local-first personal finance tool. Prior to version 26.2.1, missing authentication middleware in the ActualBudget server component allows any unaut… |
CVE-2026-27638 | High | 7.1 | 2026-02-26 | Actual is a local-first personal finance tool. Prior to version 26.2.1, in multi-user mode (OpenID), the sync API endpoints (`/sync/*`) don't verify that the a… |
CVE-2026-3089 | Medium | 6.5 | 2026-03-09 | Actual Sync Server allows authenticated users to upload files through POST /sync/upload-user-file. In versions prior to 26.3.0, improper validation of the user… |
CVE-2026-46672 | Medium | 4.6 | 2026-07-07 | Actual is a local-first personal finance app. Prior to 26.6.0, @actual-app/cli ships a hand-rolled CSV serializer in packages/cli/src/output.ts used whenever t… |
CVE-2026-46700 | Medium | 4.3 | 2026-07-07 | Actual is a local-first personal finance tool. Prior to 26.6.0, the GET /secret/:name endpoint in @actual-app/sync-server checks only that the caller has a val… |
CVE-2026-50179 | Medium | 4.2 | 2026-07-07 | Actual is a local-first personal finance tool. Prior to 26.6.0, exportToCSV and exportQueryToCSV in packages/loot-core/src/server/transactions/export/export-to… |
CVE-2026-50007 | | 2026-07-07 | Actual is an open-source personal finance application. Prior to 26.7.0, a missing authorization issue allows a shared user with user_access on a budget file to… | |
CVE-2026-43872 | | 2026-06-12 | Actual is an open-source personal finance application. Prior to version 26.5.0, several endpoints are affected by a path traversal vulnerability. Version 26.5… | |
CVE-2026-42890 | | 2026-06-12 | Actual is an open-source personal finance application. In the macOS desktop application version 25.x (built on Electron 39.2.7), the ELECTRON_RUN_AS_NODE fuse… | |
CVE-2026-42604 | | 2026-06-12 | Actual is a local-first personal finance tool. The `POST /openid/config` endpoint in Actual Budget's sync-server versions <= 26.4.0 exposes the full OpenID Con… |