# CVE-2026-27638: Actual Budget sync-server missing authorization in sync endpoints

Source: https://junglewise.ai/threats/cve-2026-27638-actual-budget-sync-server-missing-authorization-in-sync-endpoints  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-27. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-27638 · Severity: medium · CVSS 4 · Published 2026-02-27

Actual Budget's sync server is a personal finance application that stores and synchronizes users' budget data, transactions, and financial accounts. In multi-user deployments using OpenID authentication, any logged-in user can read, modify, or delete another user's complete financial data by directly accessing the sync API without proper ownership checks. An attacker can steal sensitive financial information, tamper with budget files, or destroy another user's data entirely.

Technologies: [@actual-app/sync-server (npm)](https://junglewise.ai/threats/technologies/actual-app-sync-server). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-27638 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-27638 being exploited in the wild.

**How severe is CVE-2026-27638?** Medium severity, with a CVSS score of 4, published 27 February 2026.

**Which products and versions are affected?** @actual-app/sync-server (npm) SEMVER:introduced=0,fixed=26.2.1.

**Is there a fix for CVE-2026-27638?** Yes. @actual-app/sync-server (npm): upgrade to 26.2.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-27638 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-27638?** Check whether you run @actual-app/sync-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @actual-app/sync-server (npm): upgrade to 26.2.1 or later

  ```sh
  npm install @actual-app/sync-server@26.2.1
  ```


## Technical details

The vulnerability is a missing authorization check (CWE-862) in multiple sync API endpoints within @actual-app/sync-server (file: packages/sync-server/src/app-sync.ts). While the validateSessionMiddleware confirms a user is authenticated, endpoints like /sync/download-user-file, /sync/upload-user-file, /sync/sync, /sync/user-get-key, /sync/user-create-key, /sync/reset-user-file, /sync/update-user-filename, and /sync/get-user-file-info only verify that a file exists but never check that the requesting user owns or has access to it. An authenticated attacker can provide any file ID (obtained from admin visibility, sharing, or guessing) in the X-Actual-File-Id header to read, modify, or destroy other users' budget files. The vulnerability affects versions prior to 26.2.1 and is fixed in 26.2.1 and later.

## Affected products

- Actual sync-server < 26.2.1

## Identifiers

- CVE-2026-27638
- GHSA-qmjj-p7m9-wjrv

## Timeline

- 2026-02-26: disclosed: NVD published date
- 2026-02-27: disclosed: OSV/GitHub advisory published
- 2026-02-27: patched: Fixed in version 26.2.1

## References

- [https://github.com/actualbudget/actual/security/advisories/GHSA-qmjj-p7m9-wjrv](https://github.com/actualbudget/actual/security/advisories/GHSA-qmjj-p7m9-wjrv)

## Related threats

- [Actual Sync Server CORS proxy GitHub allowlist bypass](https://junglewise.ai/threats/cve-2026-57449-actual-is-a-local-first-personal-finance-tool-prior-to-26-7-0)
- [Actual Budget insufficient session expiration for disabled OpenID users](https://junglewise.ai/threats/cve-2026-49229-actual-budget-insufficient-session-expiration-for-disabled-openid)
- [Actual sync-server improper authorization in secrets API](https://junglewise.ai/threats/cve-2026-46700-actual-sync-server-improper-authorization-in-secrets-api)
- [Actual has Privilege Escalation via 'change-password' Endpoint on OpenID-Migrated Servers](https://junglewise.ai/threats/cve-2026-33318-actual-has-privilege-escalation-via-change-password-endpoint-on)
- [Actual Sync Server authenticated path traversal in file upload](https://junglewise.ai/threats/cve-2026-3089-actual-budget-actual-sync-server-path-traversal-in-file-upload)