Is CVE-2026-27638 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-27638 being exploited in the wild.

How severe is CVE-2026-27638?

Medium severity, with a CVSS score of 4, published 27 February 2026.

Which products and versions are affected?

@actual-app/sync-server (npm) SEMVER:introduced=0,fixed=26.2.1.

Is there a fix for CVE-2026-27638?

Yes. @actual-app/sync-server (npm): upgrade to 26.2.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-27638 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-27638?

Check whether you run @actual-app/sync-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-27638: Actual Budget sync-server missing authorization in sync endpoints

CVE-2026-27638 · Severity: medium · CVSS 4 · Published 2026-02-27

Actual Budget's sync server is a personal finance application that stores and synchronizes users' budget data, transactions, and financial accounts. In multi-user deployments using OpenID authentication, any logged-in user can read, modify, or delete another user's complete financial data by directly accessing the sync API without proper ownership checks. An attacker can steal sensitive financial information, tamper with budget files, or destroy another user's data entirely.

Technologies: @actual-app/sync-server (npm). Vendors: npm.

Quick answers

Is CVE-2026-27638 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-27638 being exploited in the wild.
How severe is CVE-2026-27638?: Medium severity, with a CVSS score of 4, published 27 February 2026.
Which products and versions are affected?: @actual-app/sync-server (npm) SEMVER:introduced=0,fixed=26.2.1.
Is there a fix for CVE-2026-27638?: Yes. @actual-app/sync-server (npm): upgrade to 26.2.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-27638 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-27638?: Check whether you run @actual-app/sync-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@actual-app/sync-server (npm): upgrade to 26.2.1 or later
```
npm install @actual-app/sync-server@26.2.1
```

Technical details

The vulnerability is a missing authorization check (CWE-862) in multiple sync API endpoints within @actual-app/sync-server (file: packages/sync-server/src/app-sync.ts). While the validateSessionMiddleware confirms a user is authenticated, endpoints like /sync/download-user-file, /sync/upload-user-file, /sync/sync, /sync/user-get-key, /sync/user-create-key, /sync/reset-user-file, /sync/update-user-filename, and /sync/get-user-file-info only verify that a file exists but never check that the requesting user owns or has access to it. An authenticated attacker can provide any file ID (obtained from admin visibility, sharing, or guessing) in the X-Actual-File-Id header to read, modify, or destroy other users' budget files. The vulnerability affects versions prior to 26.2.1 and is fixed in 26.2.1 and later.

Affected products

Actual sync-server < 26.2.1

Identifiers

CVE-2026-27638
GHSA-qmjj-p7m9-wjrv

Timeline

2026-02-26: disclosed: NVD published date
2026-02-27: disclosed: OSV/GitHub advisory published
2026-02-27: patched: Fixed in version 26.2.1

References

https://github.com/actualbudget/actual/security/advisories/GHSA-qmjj-p7m9-wjrv

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.