CORS Misconfiguration in Actual Sync Server for Personal Finance Tool by Actual
CVE-2026-57449

7.1HIGH

Key Information:

Vendor

Actualbudget

Status
Actual
Vendor
CVE Published:
25 September 2026

What is CVE-2026-57449?

The Actual Sync Server for the personal finance tool is vulnerable to CORS misconfiguration, allowing authenticated users to access unauthorized resources on GitHub. Prior to version 26.7.0, the server’s CORS proxy, designed to restrict access to allowlisted repositories, incorrectly handles requests. When the ACTUAL_GITHUB_TOKEN is present, the proxy allows requests to private GitHub resources that should be protected. This is due to a flawed prefix test in the API allowlist check, which can be exploited to gain access to private data. It is crucial for users to upgrade to version 26.7.0 or later to mitigate this vulnerability.

Affected Version(s)

actual < 26.7.0

References

https://github.com/actualbudget/actual/security/advisorie...
x_refsource_CONFIRM

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.