CVE-2026-27638

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27638", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-20T22:02:30.029Z", "datePublished": "2026-02-26T22:14:21.481Z", "dateUpdated": "2026-03-02T20:48:53.277Z"}, "containers": {"cna": {"title": "ActualBudget missing authorization in sync endpoints allows cross-user budget file access in multi-user mode", "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "lang": "en", "description": "CWE-862: Missing Authorization", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 5.7, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P", "version": "4.0"}}], "references": [{"name": "https://github.com/actualbudget/actual/security/advisories/GHSA-qmjj-p7m9-wjrv", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/actualbudget/actual/security/advisories/GHSA-qmjj-p7m9-wjrv"}, {"name": "https://github.com/actualbudget/actual/commit/9966c024cb75f57943193cac8e42f401efed9d08", "tags": ["x_refsource_MISC"], "url": "https://github.com/actualbudget/actual/commit/9966c024cb75f57943193cac8e42f401efed9d08"}, {"name": "https://github.com/actualbudget/actual/releases/tag/v26.2.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/actualbudget/actual/releases/tag/v26.2.1"}], "affected": [{"vendor": "actualbudget", "product": "actual", "versions": [{"version": "< 26.2.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-26T22:14:21.481Z"}, "descriptions": [{"lang": "en", "value": "Actual is a local-first personal finance tool. Prior to version 26.2.1, in multi-user mode (OpenID), the sync API endpoints (`/sync/*`) don't verify that the authenticated user owns or has access to the file being operated on. Any authenticated user can read, modify, and overwrite any other user's budget files by providing their file ID. Version 26.2.1 patches the issue."}], "source": {"advisory": "GHSA-qmjj-p7m9-wjrv", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-02T20:48:46.903231Z", "id": "CVE-2026-27638", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-02T20:48:53.277Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27638", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-02T20:48:46.903231Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-02T20:48:50.439Z"}}], "cna": {"title": "ActualBudget missing authorization in sync endpoints allows cross-user budget file access in multi-user mode", "source": {"advisory": "GHSA-qmjj-p7m9-wjrv", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.7, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "actualbudget", "product": "actual", "versions": [{"status": "affected", "version": "< 26.2.1"}]}], "references": [{"url": "https://github.com/actualbudget/actual/security/advisories/GHSA-qmjj-p7m9-wjrv", "name": "https://github.com/actualbudget/actual/security/advisories/GHSA-qmjj-p7m9-wjrv", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/actualbudget/actual/commit/9966c024cb75f57943193cac8e42f401efed9d08", "name": "https://github.com/actualbudget/actual/commit/9966c024cb75f57943193cac8e42f401efed9d08", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/actualbudget/actual/releases/tag/v26.2.1", "name": "https://github.com/actualbudget/actual/releases/tag/v26.2.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Actual is a local-first personal finance tool. Prior to version 26.2.1, in multi-user mode (OpenID), the sync API endpoints (`/sync/*`) don't verify that the authenticated user owns or has access to the file being operated on. Any authenticated user can read, modify, and overwrite any other user's budget files by providing their file ID. Version 26.2.1 patches the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862: Missing Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-26T22:14:21.481Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27638", "state": "PUBLISHED", "dateUpdated": "2026-03-02T20:48:53.277Z", "dateReserved": "2026-02-20T22:02:30.029Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-26T22:14:21.481Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "actual", "vendor": "actualbudget", "versions": [{"status": "affected", "version": "< 26.2.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:actualbudget:actual:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "E756E18C-B2C7-46B3-AF5A-D5BCC86C53B7", "versionEndExcluding": "26.2.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Actual is a local-first personal finance tool. Prior to version 26.2.1, in multi-user mode (OpenID), the sync API endpoints (`/sync/*`) don't verify that the authenticated user owns or has access to the file being operated on. Any authenticated user can read, modify, and overwrite any other user's budget files by providing their file ID. Version 26.2.1 patches the issue."}, {"lang": "es", "value": "Actual es una herramienta de finanzas personales local-first. Antes de la versi\u00f3n 26.2.1, en modo multiusuario (OpenID), los endpoints de la API de sincronizaci\u00f3n ('/sync/*') no verifican que el usuario autenticado posea o tenga acceso al archivo sobre el que se est\u00e1 operando. Cualquier usuario autenticado puede leer, modificar y sobrescribir los archivos de presupuesto de cualquier otro usuario proporcionando su ID de archivo. La versi\u00f3n 26.2.1 soluciona el problema."}], "id": "CVE-2026-27638", "lastModified": "2026-06-17T10:27:26.207", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.2, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.7, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27638", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-02T20:48:46.903231Z", "version": "2.0.3"}}]}, "published": "2026-02-26T23:16:34.807", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/actualbudget/actual/commit/9966c024cb75f57943193cac8e42f401efed9d08"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/actualbudget/actual/releases/tag/v26.2.1"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/actualbudget/actual/security/advisories/GHSA-qmjj-p7m9-wjrv"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,26.2.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "actual", "source": "cna", "vendor": "actualbudget"}, "product": "actual", "vendor": "actualbudget"}], "analysis": {"en": {"generated_at": "2026-04-16T15:58:39.084433+00:00", "value": {"mitigation_remediation": ["Upgrade to the official 26.2.1 release or later which includes the missing authorization check for /sync/* endpoints.", "Audit and strengthen the authorization logic for the sync API routes so that any operation first confirms the authenticated OpenID user owns or has explicit access to the requested file ID.", "Implement strict validation of file identifiers so that requests for files not belonging to the current user are rejected or redirected, thereby preventing cross\u2011user data exposure."], "summary": {"action": "Immediate Patch", "impact": "Unauthorized data access"}, "threat_synthesis": {"affected_systems": "The vulnerability affects installations of actualbudget:actual on all platform versions prior to release 26.2.1 released in March 2026. Subsequent releases include the necessary patch to enforce proper ownership verification on the sync endpoints.", "description_and_impact": "Actual, a local\u2011first personal finance tool, had a missing authorization check in its sync API endpoints before version 26.2.1. The flaw is a CWE\u2011862 privilege escalation that allows any authenticated user in multi\u2011user mode to read, modify, and overwrite any other user\u2019s budget files by supplying the file\u2019s identifier. This results in a confidentiality breach and integrity compromise of sensitive financial information.", "risk_and_exploitability": "The CVSS score of 5.7 classifies the issue as moderate severity, and the EPSS score of less than 1\u202f% indicates a low probability of exploitation at the time of assessment. The vulnerability is not listed in the CISA KEV catalog. Attackers must first authenticate to the application and possess knowledge of a target user\u2019s budget file ID. Successful exploitation would grant direct access to that user\u2019s data, allowing data extraction or tampering. Given the low exploitation probability and the requirement of authenticated access, the overall risk to environments already employing the latest patch remains low, but unpatched deployments remain vulnerable."}}}}, "created": "2026-02-27T09:03:57.328116+00:00", "updated": "2026-04-16T16:00:13.889108+00:00", "vendors": ["actualbudget", "actualbudget$PRODUCT$actual"]}