Executive brief
ActualBudget is a personal finance management server that integrates with SimpleFIN and Pluggy AI to sync bank account data. An authentication bypass vulnerability allows any unauthenticated attacker with network access to query these integration endpoints and read all users' bank account balances and transaction histories. This exposes sensitive financial data for all users of affected ActualBudget instances.
Technical details
The vulnerability is a missing authentication middleware in the ActualBudget server's SimpleFIN and Pluggy.ai integration endpoints. Six endpoints (/simplefin/status, /simplefin/accounts, /simplefin/transactions, /pluggyai/status, /pluggyai/accounts, /pluggyai/transactions) lack the validateSessionMiddleware that is present in other integrations like GoCardless. An unauthenticated attacker can send POST requests over the network to these endpoints without credentials to enumerate bank accounts and retrieve complete transaction histories. The vulnerable code exists in /packages/sync-server/src/app-simplefin/app-simplefin.js and /packages/sync-server/src/app-pluggyai/app-pluggyai.js. The fix, available in version 26.2.1 and later, adds the missing authentication middleware.
Affected products
- ActualBudget sync-server <= 26.2.0
Timeline
- 2026-02-20: disclosed
- 2026-02-24: patched: Version 26.2.1 and later include the authentication middleware fix