Actual Budget Sync-server sensitive data logging in GoCardless service

Executive brief

The GoCardless integration in Actual Budget's sync server incorrectly logs sensitive financial data to standard output. This includes bank account numbers, transaction details, and authentication tokens. If an unauthorized person gains access to the server's logs, they could view private banking information or take over the linked financial accounts.

Technical details

The GoCardless component in Actual Budget's sync server uses console.log and console.debug to print API responses and error stack traces to STDOUT. This behavior results in the exposure of sensitive fields such as GoCardless bearer tokens, IBANs, bank account numbers, PII of account holders, and detailed transaction history in the server logs (e.g., Docker logs). The vulnerability is rooted in integration-bank.js and app-gocardless.js, where raw payloads and Axios error objects (containing authorization headers) are logged without sanitization. Attackers with local access to the log files or the container environment can extract these credentials and private data. The issue is patched in version 25.11.0.

Affected products

• Actual Budget @actual-app/sync-server <= 25.10.0

Timeline

• 2025-10-18: disclosed
• 2025-10-20: advisory
• 2025-11-01: patched: Based on versioning logic in advisory

References

• https://api.github.com/users/StoobertB
• https://github.com/StoobertB
• https://api.github.com/users/StoobertB/gists%7B/gist_id%7D
• https://api.github.com/users/StoobertB/repos
• https://avatars.githubusercontent.com/u/72746444?v=4
• https://api.github.com/users/StoobertB/events%7B/privacy%7D