PT-2026-21761 · Unknown+2 · Actualbudget+3

Iamsilk · Published 2026-02-24 · Updated 2026-03-01 · CVE-2026-27584

Positive Technologies (AI Summary)

CVSS v4.0

9.2

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions ActualBudget versions prior to 26.2.1

Description A missing authentication check in the ActualBudget server component allows unauthenticated users to access the SimpleFIN and Pluggy.ai integration endpoints. This allows an attacker to read sensitive bank account balance and transaction information for ActualBudget users who have these integrations enabled. The vulnerable endpoints are: /simplefin/status, /simplefin/accounts, /simplefin/transactions, /pluggyai/status, /pluggyai/accounts, and /pluggyai/transactions. The server instance must be reachable over the network for exploitation. The vulnerable source code is located in the actualbudget/actual GitHub repository within the packages/sync-server/src/app-simplefin/app-simplefin.js and packages/sync-server/src/app-pluggyai/app-pluggyai.js files. An example of a properly authenticated integration is found in packages/sync-server/src/app-gocardless/app-gocardless.js. Exploitation can be performed using curl commands to query the endpoints without authentication, retrieving account details and transaction history. Example responses include account names, balances, transaction details, and associated metadata.

Recommendations Update to version 26.2.1 or later to resolve this issue.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2026-27584

GHSA-M2CQ-XJGM-F668

Affected Products

Actualbudget

Gocardless

Pluggy.Ai

Simplefin

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27584.json · Exploit
• https://github.com/actualbudget/actual/commit/ea937d100956ca56689ff852d99c28589e2a7d88 · Patch
• https://github.com/actualbudget/actual/security/advisories/GHSA-m2cq-xjgm-f668 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m2cq-xjgm-f668 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27584 · Security Note
• https://osv.dev/vulnerability/CVE-2026-27584 · Vendor Advisory
• https://github.com/actualbudget/actual · Note
• https://reddit.com/r/VulnMatter/comments/1refon9/resumen_diario_de_vulnerabilidades_25022026 · Reddit Post
• https://twitter.com/CVEnew/status/2026676463270019413 · Twitter Post
• https://twitter.com/cracbot/status/2028062889253437750 · Twitter Post
• https://twitter.com/pulsepatchio/status/2026673915045748991 · Twitter Post
• https://twitter.com/_cvereports/status/2026510040727736824 · Twitter Post