Executive brief
Actual Budget's sync server is a personal finance application that stores and synchronizes users' budget data, transactions, and financial accounts. In multi-user deployments using OpenID authentication, any logged-in user can read, modify, or delete another user's complete financial data by directly accessing the sync API without proper ownership checks. An attacker can steal sensitive financial information, tamper with budget files, or destroy another user's data entirely.
Technical details
The vulnerability is a missing authorization check (CWE-862) in multiple sync API endpoints within @actual-app/sync-server (file: packages/sync-server/src/app-sync.ts). While the validateSessionMiddleware confirms a user is authenticated, endpoints like /sync/download-user-file, /sync/upload-user-file, /sync/sync, /sync/user-get-key, /sync/user-create-key, /sync/reset-user-file, /sync/update-user-filename, and /sync/get-user-file-info only verify that a file exists but never check that the requesting user owns or has access to it. An authenticated attacker can provide any file ID (obtained from admin visibility, sharing, or guessing) in the X-Actual-File-Id header to read, modify, or destroy other users' budget files. The vulnerability affects versions prior to 26.2.1 and is fixed in 26.2.1 and later.
Affected products
- Actual sync-server < 26.2.1
Timeline
- 2026-02-26: disclosed: NVD published date
- 2026-02-27: disclosed: OSV/GitHub advisory published
- 2026-02-27: patched: Fixed in version 26.2.1