@actual-app/sync-server

npm · Package

8 reports

Vulnerability alerts

Report	Product	Ecosystem	Severity	Fix status	Last updated
Actual Sync Server: CORS Proxy GitHub API Allowlist Prefix Bypass Leaks Private Repositories Through the Server GitHub TokenCVE-2026-57449 · GHSA-M62C-5Q34-F3CF	@actual-app/sync-server	npm	High	Fix reported	2026-10-07
@actual-app/sync-server: Disabled OpenID users keep access through existing session tokensCVE-2026-49229 · GHSA-CQ9C-6W48-QMFG	@actual-app/sync-server	npm	High	Fix reported	2026-09-10
@actual-app/sync-server's missing authorization on GET /secret/:name allows non-admin OpenID users to enumerate admin-configured bank-sync secretsCVE-2026-46700 · GHSA-3F62-QV96-4P78	@actual-app/sync-server	npm	Medium	Fix reported	2026-09-10
Actual Sync-server Gocardless service is logging sensitive data including bearer tokens and account numbersGHSA-XVP7-8VM8-XFXX	@actual-app/sync-server	npm	Medium	Fix reported	2026-09-10
Actual has Privilege Escalation via 'change-password' Endpoint on OpenID-Migrated ServersCVE-2026-33318 · GHSA-PRP4-2F49-FCGP	@actual-app/sync-server	npm	High	Fix reported	2026-05-05
Actual Sync Server has an Authenticated Path TraversalCVE-2026-3089 · GHSA-27VG-33GH-4HWG	@actual-app/sync-server	npm	Medium	Fix reported	2026-03-10
@actual-app/sync-server: Missing authorization in sync endpoints allows cross-user budget file access in multi-user modeCVE-2026-27638 · GHSA-QMJJ-P7M9-WJRV	@actual-app/sync-server	npm	Medium	Fix reported	2026-02-28
ActualBudget server is Missing Authentication for SimpleFIN and Pluggy AI bank sync endpointsCVE-2026-27584 · GHSA-M2CQ-XJGM-F668	@actual-app/sync-server	npm	Critical	Fix reported	2026-02-24