by Kastro
Paper/Archive/CVE-2026-27584

CVE-2026-27584

actualbudget actual — ActualBudget server is Missing Authentication for SimpleFIN and Pluggy AI bank sync endpoints

EPSS 0.4%public exploitCVSS 9.2
critical.is priorityof 100
45
CVSS 9.2 (CNA)9.2 / 10 × 3027.6Not in CISA KEV+300.0EPSS percentile 39.1.391 × 207.8Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Actual is a local-first personal finance tool. Prior to version 26.2.1, missing authentication middleware in the ActualBudget server component allows any unauthenticated user to query the SimpleFIN and Pluggy.ai integration endpoints and read sensitive bank account balance and transaction information. This vulnerability allows an unauthenticated attacker to read the bank account balance and transaction history of ActualBudget users. This vulnerability impacts all ActualBudget Server users with the SimpleFIN or Pluggy.ai integrations configured. The ActualBudget Server instance must be reachable over the network. Version 26.2.1 patches the issue.

Affected

ProductAffectedFixed inSource
actual< 26.2.1–CNA

Scores by source

GitHub_M (CNA)9.2CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: partial

References

refgithub.com/actualbudget/actual/security/advisories/GHSA-m2cq-xjgm-f668refgithub.com/actualbudget/actual/commit/ea937d100956ca56689ff852d99c28589e2a7d88