npm/@actual-app/sync-server

Actual Sync Server has an Authenticated Path Traversal

Modified: 3/10/2026

@actual-app/sync-server's missing authorization on GET /secret/:name allows non-admin OpenID users to enumerate admin-configured bank-sync secrets

Modified: 9/10/2026

@actual-app/sync-server: Disabled OpenID users keep access through existing session tokens

Modified: 9/10/2026

ActualBudget server is Missing Authentication for SimpleFIN and Pluggy AI bank sync endpoints

Modified: 2/24/2026

Actual has Privilege Escalation via 'change-password' Endpoint on OpenID-Migrated Servers

Modified: 5/5/2026

@actual-app/sync-server: Missing authorization in sync endpoints allows cross-user budget file access in multi-user mode

Modified: 2/28/2026

Actual Sync-server Gocardless service is logging sensitive data including bearer tokens and account numbers

Modified: 9/10/2026