5.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-27638

CVE-2026-27638: @actual-app/sync-server: Missing authorization in sync endpoints allows cross-user budget file access in multi-user mode

In multi-user mode (OpenID), the sync API endpoints (/sync/*) don't verify that the authenticated user owns or has access to the file being operated on. Any authenticated user can read, modify, and overwrite any other user's budget files by providing their file ID.

Affected Code

File: packages/sync-server/src/app-sync.ts

The validateSessionMiddleware on line 31 confirms the user is authenticated, but individual endpoints only check that the file exists (via verifyFileExists), never that the requesting user owns or has access to the file.

Compare with POST /sync/delete-user-file (lines 394-430) which correctly checks:

const isOwner = file.owner === userId;
const isServerAdmin = isAdmin(userId);
if (!isOwner && !isServerAdmin) { ... }

This check is missing from all other endpoints.

Affected Endpoints

GET /sync/download-user-file - download any budget file
POST /sync/upload-user-file - overwrite any budget file
POST /sync/sync - read/write sync messages of any file
POST /sync/user-get-key - read encryption key info
POST /sync/user-create-key - change encryption key
POST /sync/reset-user-file - reset sync state
POST /sync/update-user-filename - rename file
GET /sync/get-user-file-info - read file metadata

PoC

Setup: Two users (Alice, Bob) authenticated via OpenID on the same Actual server. Alice has a budget with fileId abc-123.

Bob downloads Alice's budget:

curl -X GET 'https://actual.example.com/sync/download-user-file' \
  -H 'X-Actual-Token: <bob-session-token>' \
  -H 'X-Actual-File-Id: abc-123' \
  -o stolen-budget.blob

Miggo Vulnerability Database

→

CVE-2026-27638

CVE-2026-27638:

5.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@actual-app/sync-server	npm	<= 26.2.0	26.2.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic Missing Authorization (CWE-862) issue across multiple API endpoints in the @actual-app/sync-server package. In a multi-user environment, the sync API endpoints located in packages/sync-server/src/app-sync.ts would authenticate a user but failed to authorize their access to specific budget files. The application only verified that a file ID was valid but never checked if the authenticated user was the owner of that file or had explicit access rights.

The patch introduces a centralized authorization function, requireFileAccess, which checks for file ownership or administrative privileges before allowing an operation to proceed. This function is now called by all the previously vulnerable API handlers (/sync, /user-get-key, /user-create-key, /reset-user-file, /upload-user-file, /download-user-file, /update-user-filename, and /get-user-file-info).

During exploitation, a runtime profiler would show activity within the anonymous functions that handle these Express.js routes. Since these handlers lacked the proper authorization checks, any authenticated user could perform sensitive actions like downloading, modifying, or deleting another user's financial data by simply providing the correct file ID.

Vulnerable functions

app.post('/sync')

packages/sync-server/src/app-sync.ts

The handler for the '/sync' endpoint was missing an authorization check. It did not verify if the authenticated user had ownership of or access to the file identified by the `fileId`, allowing any authenticated user to read and write sync messages for any file.

app.post('/user-get-key')

packages/sync-server/src/app-sync.ts

The handler for the '/user-get-key' endpoint was missing an authorization check. It only verified that the file exists but did not check for user ownership, allowing any authenticated user to retrieve encryption key information for any file.

app.post('/user-create-key')

packages/sync-server/src/app-sync.ts

The handler for the '/user-create-key' endpoint was missing an authorization check. It allowed any authenticated user to create or change the encryption key for any user's budget file, as it did not validate file ownership.

app.post('/reset-user-file')

packages/sync-server/src/app-sync.ts

The handler for the '/reset-user-file' endpoint was missing an authorization check. This allowed any authenticated user to reset the sync state of any other user's budget file, leading to potential data loss.

app.post('/upload-user-file')

packages/sync-server/src/app-sync.ts

The handler for the '/upload-user-file' endpoint was missing an authorization check. It did not verify file ownership, allowing any authenticated user to overwrite any other user's budget file.

app.get('/download-user-file')

packages/sync-server/src/app-sync.ts

The handler for the '/download-user-file' endpoint was missing an authorization check. It failed to verify that the requesting user owned the file, allowing any authenticated user to download any other user's budget file.

app.post('/update-user-filename')

packages/sync-server/src/app-sync.ts

The handler for the '/update-user-filename' endpoint was missing an authorization check. This allowed any authenticated user to rename any other user's budget file without proper authorization.

app.get('/get-user-file-info')

packages/sync-server/src/app-sync.ts

The handler for the '/get-user-file-info' endpoint was missing an authorization check. It did not verify file ownership, enabling any authenticated user to read the metadata of any other user's budget file.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

5.7

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-27638: @actual-app/sync-server: Missing authorization in sync endpoints allows cross-user budget file access in multi-user mode

Affected Code

Affected Endpoints

PoC

CVE-2026-27638:

5.7

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Detect and Respond To Threats Faster.

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

Technical Details

5.7

5.7

CVE-2026-27638: @actual-app/sync-server: Missing authorization in sync endpoints allows cross-user budget file access in multi-user mode

Affected Code

Affected Endpoints

PoC

Basic Information

Basic Information

Impact

5.7

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-27638: @actual-app/sync-server: Missing authorization in sync endpoints allows cross-user budget file access in multi-user mode

Affected Code

Affected Endpoints

PoC

CVE-2026-27638:

5.7

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Technical Details

5.7

5.7

CVE-2026-27638: @actual-app/sync-server: Missing authorization in sync endpoints allows cross-user budget file access in multi-user mode

Affected Code

Affected Endpoints

PoC

Basic Information

Basic Information

Impact

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI