# CVE-2026-57449: Actual Sync Server CORS proxy GitHub allowlist bypass

Source: https://junglewise.ai/threats/cve-2026-57449-actual-is-a-local-first-personal-finance-tool-prior-to-26-7-0  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-25. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-57449 · Severity: high · CVSS 4 · Published 2026-09-25

Actual Sync Server's CORS proxy feature, when enabled and configured with a GitHub token, allows authenticated users to access private GitHub repositories that the server can reach. An attacker with a valid user session can exploit a prefix-matching bug in the GitHub API allowlist to request private resources from repositories whose names start with an allowlisted repository name (e.g., requesting "acme/plugin-private" when "acme/plugin" is allowlisted). This could expose sensitive data like credentials stored in private repositories.

Technologies: [Actual Budget Sync Server](https://junglewise.ai/threats/technologies/sync-server), [@actual-app/sync-server (npm)](https://junglewise.ai/threats/technologies/actual-app-sync-server). Vendors: [Actual Budget](https://junglewise.ai/threats/vendors/actual-budget), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-57449 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-57449 being exploited in the wild.

**How severe is CVE-2026-57449?** High severity, with a CVSS score of 4, published 25 September 2026.

**Which products and versions are affected?** Actual Budget Sync Server prior to 26.7.0; @actual-app/sync-server (npm) <= 26.6.0, SEMVER:introduced=0,fixed=26.7.0.

**Is there a fix for CVE-2026-57449?** Yes. @actual-app/sync-server (npm): upgrade to 26.7.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-57449 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-57449?** Check whether you run Actual Budget Sync Server or @actual-app/sync-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @actual-app/sync-server (npm): upgrade to 26.7.0 or later

  ```sh
  npm install @actual-app/sync-server@26.7.0
  ```


## Technical details

The vulnerability is an authorization bypass in the CORS proxy's GitHub API allowlist check. The code uses a raw startsWith() comparison on the GitHub API path without requiring a path boundary delimiter after the repository name, allowing `/repos/acme/plugin-private` to match the allowlist entry for `/repos/acme/plugin`. The proxy then forwards authenticated requests with the server's GitHub token to any such matching API endpoint. Exploitation requires: CORS proxy enabled, server configured with a GitHub token, an allowlisted public repository, and any authenticated Actual user session.

## Affected products

- Actual Budget Sync Server prior to 26.7.0

## Identifiers

- CVE-2026-57449
- GHSA-m62c-5q34-f3cf

## Timeline

- 2026-09-23: disclosed: GitHub Security Advisory published
- 2026-09-25: patched: Fix released in version 26.7.0

## References

- [https://github.com/actualbudget/actual/security/advisories/GHSA-m62c-5q34-f3cf](https://github.com/actualbudget/actual/security/advisories/GHSA-m62c-5q34-f3cf)

## Related threats

- [Actual Budget insufficient session expiration for disabled OpenID users](https://junglewise.ai/threats/cve-2026-49229-actual-budget-insufficient-session-expiration-for-disabled-openid)
- [Actual sync-server improper authorization in secrets API](https://junglewise.ai/threats/cve-2026-46700-actual-sync-server-improper-authorization-in-secrets-api)
- [Actual Budget sync-server information disclosure in OpenID config](https://junglewise.ai/threats/cve-2026-42604-actual-budget-sync-server-information-disclosure-in-openid-config)
- [Actual has Privilege Escalation via 'change-password' Endpoint on OpenID-Migrated Servers](https://junglewise.ai/threats/cve-2026-33318-actual-has-privilege-escalation-via-change-password-endpoint-on)
- [Actual Sync Server authenticated path traversal in file upload](https://junglewise.ai/threats/cve-2026-3089-actual-budget-actual-sync-server-path-traversal-in-file-upload)