CVE-2026-27584: ActualBudget Server Lacks Authentication for SimpleFIN and Pluggy AI Endpoints
Summary
CVE-2026-27584: ActualBudget server is Missing Authentication for SimpleFIN and Pluggy AI bank sync endpoints. Affects @actual-app/sync-server versions < 26.2.1. Fixed in 26.2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
ActualBudget is an open-source personal finance management tool that helps users track their expenses, budgets, and bank transactions. It integrates with various financial services, including SimpleFIN and Pluggy.ai, to provide users with real-time access to their bank account balances and transaction histories. However, a critical vulnerability has been identified in the server component that allows unauthorized access to sensitive financial data.
Vulnerability Detail
The ActualBudget server is missing authentication middleware for its SimpleFIN and Pluggy.ai integration endpoints. This oversight permits any unauthenticated user to access sensitive bank account balance and transaction information, posing a significant risk to user privacy and security. The affected endpoints are intended solely for authenticated users, and their exposure could lead to unauthorized data access and potential financial fraud.
How To Fix
Latest published version: 26.10.0 as of 23 Oct 2026
npm install @actual-app/sync-server@26.10.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
26.2.1
This is the first release that contains the fix.
npm install @actual-app/sync-server@26.2.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement authentication middleware in your server code. Here is an example of how to add authentication to the SimpleFIN integration:
const express = require('express');
const app = express();
app.use(requestLoggerMiddleware);
app.use(express.json());
app.use(validateSessionMiddleware);
// <-- Ensure this middleware is used for authentication
Conclusion
The ActualBudget server vulnerability (CVE-2026-27584) poses a significant risk by allowing unauthorized access to sensitive financial data. Users are strongly advised to update to the patched version to secure their applications and protect their financial information.
See every vulnerability recorded for @actual-app/sync-server →
FAQ
CVE-2026-27584 is a vulnerability in the ActualBudget server that allows unauthorized access to sensitive bank account information through SimpleFIN and Pluggy.ai endpoints.
This vulnerability allows unauthenticated attackers to read bank account balances and transaction histories, potentially leading to financial fraud.
If you are using an affected version of ActualBudget, you should update to version 26.2.1 or later to mitigate the vulnerability.
Yes, you can use Vulert, which monitors open-source vulnerabilities in your software. You can check your application without signing up by using the Vulert playground.
The CVSS score of this vulnerability is 9.2, indicating a critical level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for @actual-app/sync-server.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
