9.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-27584

CVE-2026-27584: ActualBudget server is Missing Authentication for SimpleFIN and Pluggy AI bank sync endpoints

Actual is a local-first personal finance tool. Prior to version 26.2.1, missing authentication middleware in the ActualBudget server component allows any unauthenticated user to query the SimpleFIN and Pluggy.ai integration endpoints and read sensitive bank account balance and transaction information. This vulnerability allows an unauthenticated attacker to read the bank account balance and transaction history of ActualBudget users. This vulnerability impacts all ActualBudget Server users with the SimpleFIN or Pluggy.ai integrations configured. The ActualBudget Server instance must be reachable over the network. Version 26.2.1 patches the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-27584

CVE-2026-27584:

9.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@actual-app/sync-server	npm	< 26.2.1	26.2.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a missing authentication control in the ActualBudget server, specifically affecting the SimpleFIN and Pluggy.ai integration endpoints. The analysis of the fixing commit ea937d100956ca56689ff852d99c28589e2a7d88 confirms this. The patch applies the validateSessionMiddleware to the express.js applications defined in app-simplefin.js and app-pluggyai.js. Before this change, these applications did not enforce any authentication, leaving several sensitive endpoints exposed. An unauthenticated attacker could make POST requests to endpoints like /simplefin/accounts and /pluggyai/transactions to retrieve sensitive financial data, including account balances and transaction histories. The vulnerable functions are the route handlers for these endpoints, which would process the unauthenticated requests. While these handlers are anonymous functions, they are the code that would execute during exploitation and are therefore the focus of this analysis.

Vulnerable functions

app.post:/simplefin/status

packages/sync-server/src/app-simplefin/app-simplefin.js

This file defines the express application for SimpleFIN integration. The vulnerability is the absence of the `validateSessionMiddleware` before the patch. This allowed unauthenticated access to the handler for the `/simplefin/status` endpoint, which processes requests to check SimpleFIN configuration status.

app.post:/simplefin/accounts

packages/sync-server/src/app-simplefin/app-simplefin.js

This file defines the express application for SimpleFIN integration. The vulnerability is the absence of the `validateSessionMiddleware` before the patch. This allowed unauthenticated access to the handler for the `/simplefin/accounts` endpoint, which processes requests to list a user's bank accounts.

app.post:/simplefin/transactions

packages/sync-server/src/app-simplefin/app-simplefin.js

This file defines the express application for SimpleFIN integration. The vulnerability is the absence of the `validateSessionMiddleware` before the patch. This allowed unauthenticated access to the handler for the `/simplefin/transactions` endpoint, which processes requests to list bank account transactions.

app.post:/pluggyai/status

packages/sync-server/src/app-pluggyai/app-pluggyai.js

This file defines the express application for Pluggy.ai integration. The vulnerability is the absence of the `validateSessionMiddleware` before the patch. This allowed unauthenticated access to the handler for the `/pluggyai/status` endpoint, which processes requests to check Pluggy.ai configuration status.

app.post:/pluggyai/accounts

packages/sync-server/src/app-pluggyai/app-pluggyai.js

This file defines the express application for Pluggy.ai integration. The vulnerability is the absence of the `validateSessionMiddleware` before the patch. This allowed unauthenticated access to the handler for the `/pluggyai/accounts` endpoint, which processes requests to list a user's bank accounts.

app.post:/pluggyai/transactions

packages/sync-server/src/app-pluggyai/app-pluggyai.js

This file defines the express application for Pluggy.ai integration. The vulnerability is the absence of the `validateSessionMiddleware` before the patch. This allowed unauthenticated access to the handler for the `/pluggyai/transactions` endpoint, which processes requests to list bank account transactions.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.