CVE-2026-27584 ActualBudget server is Missing Authentication for SimpleFIN and Pluggy AI bank sync endpoints
Unauthenticated attackers can read sensitive bank account balances and transaction history via SimpleFIN or Pluggy AI endpoints in ActualBudget Server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-27584?
CVE-2026-27584 is a critical missing authorization vulnerability in actualbudget actual, published on 24 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Actual is a local-first personal finance tool. Prior to version 26.2.1, missing authentication middleware in the ActualBudget server component allows any unauthenticated user to query the SimpleFIN and Pluggy.ai integration endpoints and read sensitive bank account balance and transaction information. This vulnerability allows an unauthenticated attacker to read the bank account balance and transaction history of ActualBudget users. This vulnerability impacts all ActualBudget Server users with the SimpleFIN or Pluggy.ai integrations configured. The ActualBudget Server instance must be reachable over the network. Version 26.2.1 patches the issue.
Weakness: CWE-306
Which versions are affected by CVE-2026-27584?
2 open source packages ship an affected version, including @actual-app/sync-server. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@actual-app/sync-server npm | All versions | 26.2.1 |
@actual-app/sync-server npm | All versions | 26.2.1 |
Products include Actualbudget Actual.
How do I fix CVE-2026-27584?
Upgrade @actual-app/sync-server to 26.2.1 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-27584 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-27584 exists.
Other vulnerabilities in actualbudget actual
Sources
Also known as GHSA-m2cq-xjgm-f668.