CVE-2026-27584

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27584", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-20T17:40:28.450Z", "datePublished": "2026-02-24T14:59:21.175Z", "dateUpdated": "2026-02-27T20:48:57.689Z"}, "containers": {"cna": {"title": "ActualBudget server is Missing Authentication for SimpleFIN and Pluggy AI bank sync endpoints", "problemTypes": [{"descriptions": [{"cweId": "CWE-306", "lang": "en", "description": "CWE-306: Missing Authentication for Critical Function", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 9.2, "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/actualbudget/actual/security/advisories/GHSA-m2cq-xjgm-f668", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/actualbudget/actual/security/advisories/GHSA-m2cq-xjgm-f668"}, {"name": "https://github.com/actualbudget/actual/commit/ea937d100956ca56689ff852d99c28589e2a7d88", "tags": ["x_refsource_MISC"], "url": "https://github.com/actualbudget/actual/commit/ea937d100956ca56689ff852d99c28589e2a7d88"}], "affected": [{"vendor": "actualbudget", "product": "actual", "versions": [{"version": "< 26.2.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-24T14:59:21.175Z"}, "descriptions": [{"lang": "en", "value": "Actual is a local-first personal finance tool. Prior to version 26.2.1, missing authentication middleware in the ActualBudget server component allows any unauthenticated user to query the SimpleFIN and Pluggy.ai integration endpoints and read sensitive bank account balance and transaction information. This vulnerability allows an unauthenticated attacker to read the bank account balance and transaction history of ActualBudget users. This vulnerability impacts all ActualBudget Server users with the SimpleFIN or Pluggy.ai integrations configured. The ActualBudget Server instance must be reachable over the network. Version 26.2.1 patches the issue."}], "source": {"advisory": "GHSA-m2cq-xjgm-f668", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-27T20:48:49.123871Z", "id": "CVE-2026-27584", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-27T20:48:57.689Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27584", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-27T20:48:49.123871Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-27T20:48:54.415Z"}}], "cna": {"title": "ActualBudget server is Missing Authentication for SimpleFIN and Pluggy AI bank sync endpoints", "source": {"advisory": "GHSA-m2cq-xjgm-f668", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 9.2, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "actualbudget", "product": "actual", "versions": [{"status": "affected", "version": "< 26.2.1"}]}], "references": [{"url": "https://github.com/actualbudget/actual/security/advisories/GHSA-m2cq-xjgm-f668", "name": "https://github.com/actualbudget/actual/security/advisories/GHSA-m2cq-xjgm-f668", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/actualbudget/actual/commit/ea937d100956ca56689ff852d99c28589e2a7d88", "name": "https://github.com/actualbudget/actual/commit/ea937d100956ca56689ff852d99c28589e2a7d88", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Actual is a local-first personal finance tool. Prior to version 26.2.1, missing authentication middleware in the ActualBudget server component allows any unauthenticated user to query the SimpleFIN and Pluggy.ai integration endpoints and read sensitive bank account balance and transaction information. This vulnerability allows an unauthenticated attacker to read the bank account balance and transaction history of ActualBudget users. This vulnerability impacts all ActualBudget Server users with the SimpleFIN or Pluggy.ai integrations configured. The ActualBudget Server instance must be reachable over the network. Version 26.2.1 patches the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-306", "description": "CWE-306: Missing Authentication for Critical Function"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-24T14:59:21.175Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27584", "state": "PUBLISHED", "dateUpdated": "2026-02-27T20:48:57.689Z", "dateReserved": "2026-02-20T17:40:28.450Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-24T14:59:21.175Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "actual", "vendor": "actualbudget", "versions": [{"status": "affected", "version": "< 26.2.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:actualbudget:actual:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "E756E18C-B2C7-46B3-AF5A-D5BCC86C53B7", "versionEndExcluding": "26.2.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Actual is a local-first personal finance tool. Prior to version 26.2.1, missing authentication middleware in the ActualBudget server component allows any unauthenticated user to query the SimpleFIN and Pluggy.ai integration endpoints and read sensitive bank account balance and transaction information. This vulnerability allows an unauthenticated attacker to read the bank account balance and transaction history of ActualBudget users. This vulnerability impacts all ActualBudget Server users with the SimpleFIN or Pluggy.ai integrations configured. The ActualBudget Server instance must be reachable over the network. Version 26.2.1 patches the issue."}, {"lang": "es", "value": "Actual es una herramienta de finanzas personales local-first. Antes de la versi\u00f3n 26.2.1, la falta de middleware de autenticaci\u00f3n en el componente de servidor de ActualBudget permit\u00eda a cualquier usuario no autenticado consultar los endpoints de integraci\u00f3n de SimpleFIN y Pluggy.ai y leer informaci\u00f3n sensible sobre el saldo de cuentas bancarias y transacciones. Esta vulnerabilidad permite a un atacante no autenticado leer el saldo de la cuenta bancaria y el historial de transacciones de los usuarios de ActualBudget. Esta vulnerabilidad afecta a todos los usuarios del servidor de ActualBudget con las integraciones de SimpleFIN o Pluggy.ai configuradas. La instancia del servidor de ActualBudget debe ser accesible a trav\u00e9s de la red. La versi\u00f3n 26.2.1 corrige el problema."}], "id": "CVE-2026-27584", "lastModified": "2026-06-17T10:27:20.640", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.2, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27584", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-27T20:48:49.123871Z", "version": "2.0.3"}}]}, "published": "2026-02-24T15:21:39.010", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/actualbudget/actual/commit/ea937d100956ca56689ff852d99c28589e2a7d88"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/actualbudget/actual/security/advisories/GHSA-m2cq-xjgm-f668"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-306"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,26.2.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "actual", "source": "cna", "vendor": "actualbudget"}, "product": "actual", "vendor": "actualbudget"}], "analysis": {"en": {"generated_at": "2026-04-16T16:25:42.178809+00:00", "value": {"mitigation_remediation": ["Upgrade the ActualBudget Server to version 26.2.1 or later, which includes the authentication fix for the affected endpoints.", "If upgrading immediately is not possible, restrict inbound access to the server using firewall rules or VPN to only trusted hosts, limiting the attack surface.", "As a temporary workaround, remove or disable the SimpleFIN and Pluggy.ai integrations until the patch is applied."], "summary": {"action": "Apply Patch", "impact": "Unauthorized disclosure of bank account balances and transaction history"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the ActualBudget server component for all versions before 26.2.1 when the SimpleFIN or Pluggy.ai integrations are enabled. It applies to any instance reachable over a network, regardless of platform, and applies to all users that have these integrations configured.", "description_and_impact": "A missing authentication check on the ActualBudget server exposes the SimpleFIN and Pluggy.ai integration endpoints to any network user, allowing read access to sensitive bank account balances and transaction histories. The flaw is a classic missing authentication weakness (CWE\u2011306) and can result in the compromise of confidential financial data for all affected users.", "risk_and_exploitability": "The CVSS base score of 9.2 indicates critical severity. The EPSS score of less than 1% suggests a low general exploitation probability, yet the exposure is still serious because the attacker only needs network connectivity to the server. The vulnerability is not listed in the CISA KEV catalog, meaning it has not yet been reported as a known exploited vulnerability, but the lack of authentication provides an easy attack path for anyone who can reach the server from the internet or an internal network."}}}}, "created": "2026-02-25T11:38:53.852347+00:00", "updated": "2026-04-16T16:30:15.941397+00:00", "vendors": ["actualbudget", "actualbudget$PRODUCT$actual"]}