Is CVE-2026-27584 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-27584 being exploited in the wild.

How severe is CVE-2026-27584?

Medium severity, with a CVSS score of 4, published 24 February 2026.

Which products and versions are affected?

@actual-app/sync-server (npm) SEMVER:introduced=0,fixed=26.2.1.

Is there a fix for CVE-2026-27584?

Yes. @actual-app/sync-server (npm): upgrade to 26.2.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-27584 attacked?

It is attacked over the network.

Am I affected by CVE-2026-27584?

Check whether you run @actual-app/sync-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-27584: ActualBudget missing authentication in SimpleFIN and Pluggy AI sync endpoints

CVE-2026-27584 · Severity: medium · CVSS 4 · Published 2026-02-24

ActualBudget is a personal finance management server that integrates with SimpleFIN and Pluggy AI to sync bank account data. An authentication bypass vulnerability allows any unauthenticated attacker with network access to query these integration endpoints and read all users' bank account balances and transaction histories. This exposes sensitive financial data for all users of affected ActualBudget instances.

Technologies: @actual-app/sync-server (npm). Vendors: npm.

Quick answers

Is CVE-2026-27584 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-27584 being exploited in the wild.
How severe is CVE-2026-27584?: Medium severity, with a CVSS score of 4, published 24 February 2026.
Which products and versions are affected?: @actual-app/sync-server (npm) SEMVER:introduced=0,fixed=26.2.1.
Is there a fix for CVE-2026-27584?: Yes. @actual-app/sync-server (npm): upgrade to 26.2.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-27584 attacked?: It is attacked over the network.
Am I affected by CVE-2026-27584?: Check whether you run @actual-app/sync-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@actual-app/sync-server (npm): upgrade to 26.2.1 or later
```
npm install @actual-app/sync-server@26.2.1
```

Technical details

The vulnerability is a missing authentication middleware in the ActualBudget server's SimpleFIN and Pluggy.ai integration endpoints. Six endpoints (/simplefin/status, /simplefin/accounts, /simplefin/transactions, /pluggyai/status, /pluggyai/accounts, /pluggyai/transactions) lack the validateSessionMiddleware that is present in other integrations like GoCardless. An unauthenticated attacker can send POST requests over the network to these endpoints without credentials to enumerate bank accounts and retrieve complete transaction histories. The vulnerable code exists in /packages/sync-server/src/app-simplefin/app-simplefin.js and /packages/sync-server/src/app-pluggyai/app-pluggyai.js. The fix, available in version 26.2.1 and later, adds the missing authentication middleware.

Affected products

ActualBudget sync-server <= 26.2.0

Identifiers

CVE-2026-27584
GHSA-m2cq-xjgm-f668

Timeline

2026-02-20: disclosed
2026-02-24: patched: Version 26.2.1 and later include the authentication middleware fix

References

https://github.com/actualbudget/actual/security/advisories/GHSA-m2cq-xjgm-f668

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.