PT-2026-22202 · Actual · Actual

Q1Uf3Ng · Published 2026-02-26 · Updated 2026-03-25 · CVE-2026-27638

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions Actual versions prior to 26.2.1

Description Actual is a local-first personal finance tool. In multi-user mode (OpenID), the sync API endpoints (/sync/*) do not verify that the authenticated user owns or has access to the file being operated on. Any authenticated user can read, modify, and overwrite any other user's budget files by providing their file ID. The issue affects the following API endpoints: /sync/download-user-file, /sync/upload-user-file, /sync/sync, /sync/user-get-key, /sync/user-create-key, /sync/reset-user-file, /sync/update-user-filename, and /sync/get-user-file-info. The validateSessionMiddleware confirms user authentication, but endpoints lack checks to ensure the user owns or has access to the file. File IDs can be discovered through various methods, including admin access and user sharing. This allows an attacker to steal financial data, modify budgets, and tamper with encryption keys.

Recommendations Update to version 26.2.1 or later.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-27638

GHSA-QMJJ-P7M9-WJRV

Affected Products

Actual

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27638.json · Exploit
• https://github.com/actualbudget/actual/commit/9966c024cb75f57943193cac8e42f401efed9d08 · Patch
• https://github.com/actualbudget/actual/security/advisories/GHSA-qmjj-p7m9-wjrv · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-27638 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qmjj-p7m9-wjrv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27638 · Security Note
• https://github.com/actualbudget/actual · Note
• https://github.com/actualbudget/actual/releases/tag/v26.2.1 · Note
• https://twitter.com/q1uf3ng/status/2036824777642655889 · Twitter Post
• https://twitter.com/cracbot/status/2028787693594071322 · Twitter Post
• https://twitter.com/_cvereports/status/2027468824476311934 · Twitter Post
• https://twitter.com/CVEnew/status/2027466643891491239 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2027216173016719384 · Twitter Post