Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

actual — Vulnerabilities & Security Advisories 11

All 11 CVE vulnerabilities found in actual, with AI-generated Chinese analysis, references, and POCs.

Vendor: actualbudget

CVE IDTitleCVSSSeverityPublished
CVE-2026-49229 Actual: Disabled OpenID users keep access through existing session tokens CWE-613 8.3 High2026-07-07
CVE-2026-50179 Actual: CSV Formula Injection in Transaction Export via Imported Payee/Notes Fields CWE-1236 4.2 Medium2026-07-07
CVE-2026-46700 Actual: Missing authorization on GET /secret/:name allows non-admin OpenID users to enumerate admin-configured bank-sync secrets CWE-285 4.3 Medium2026-07-07
CVE-2026-46672 Actual: CSV Formula Injection in `@actual-app/cli` `--format csv` Output via Custom `escapeCsv` Helper CWE-1236 4.6 Medium2026-07-07
CVE-2026-50007 Actual: Shared users can perform owner-only file management actions CWE-862--2026-07-07
CVE-2026-43872 actual-server has a path traversal vulnerability CWE-22--2026-06-12
CVE-2026-42890 actual Allows Electron to Run As Node CWE-94--2026-06-12
CVE-2026-42604 Actual has an OpenID `client_secret` Disclosure via Broken Authorization Guard in `/openid/config` CWE-863--2026-06-12
CVE-2026-33318 Actual has Privilege Escalation via 'change-password' Endpoint on OpenID-Migrated Servers CWE-284 8.8 High2026-04-24
CVE-2026-27638 ActualBudget missing authorization in sync endpoints allows cross-user budget file access in multi-user mode CWE-862 8.1AIHighAI2026-02-26
CVE-2026-27584 ActualBudget server is Missing Authentication for SimpleFIN and Pluggy AI bank sync endpoints CWE-306 7.5 -2026-02-24

All 11 known CVE vulnerabilities affecting actual with full Chinese analysis, references, and POCs where available.