{"id":"EUVD-2026-87369","enisaUuid":"19087dff-00e5-3202-b135-d6cfbd41f2de","description":"Actual is a local-first personal finance tool. Prior to 26.7.0, Actual Sync Server\u0027s CORS proxy is intended to let authenticated users fetch resources only from repositories listed in the official plugin allowlist. When `ACTUAL_GITHUB_TOKEN` is configured, the proxy automatically attaches the server\u0027s GitHub token to GitHub requests. The GitHub API allowlist check uses a raw `startsWith()` prefix test for `/repos/{owner}/{repo}` without requiring a path boundary after the repository name. If an allowlisted public plugin repository is `https://github.com/acme/plugin`, the proxy also accepts GitHub API URLs. Those URLs are outside the allowlisted repository but still pass because their API path starts with `/repos/acme/plugin`. The proxy then forwards the request with the server\u0027s `ACTUAL_GITHUB_TOKEN`, allowing any authenticated Actual user to read private GitHub resources reachable by that token. Version 26.7.0 fixes the issue.","datePublished":"Sep 25, 2026, 10:10:39 PM","dateUpdated":"Sep 28, 2026, 1:07:46 PM","baseScore":7.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/actualbudget/actual/security/advisories/GHSA-m62c-5q34-f3cf\n","aliases":"CVE-2026-57449\nGHSA-m62c-5q34-f3cf\n","assigner":"GitHub_M","epss":0.26,"enisaIdProduct":[{"id":"3a539408-5a87-35ee-bb48-bcbd3d56997f","product":{"name":"actual","vendor":{"name":"actualbudget"}},"product_version":"\u003c 26.7.0"}],"enisaIdVendor":[{"id":"a8930257-b323-3990-8737-23572305500a","vendor":{"name":"actualbudget"}}],"enisaIdVulnerability":[{"id":"23777da0-c82b-30d9-b39b-5fc74068cbb5","vulnerability":{"id":"CVE-2026-57449","description":"Actual is a local-first personal finance tool. Prior to 26.7.0, Actual Sync Server\u0027s CORS proxy is intended to let authenticated users fetch resources only from repositories listed in the official plugin allowlist. When `ACTUAL_GITHUB_TOKEN` is configured, the proxy automatically attaches the server\u0027s GitHub token to GitHub requests. The GitHub API allowlist check uses a raw `startsWith()` prefix test for `/repos/{owner}/{repo}` without requiring a path boundary after the repository name. If an allowlisted public plugin repository is `https://github.com/acme/plugin`, the proxy also accepts GitHub API URLs. Those URLs are outside the allowlisted repository but still pass because their API path starts with `/repos/acme/plugin`. The proxy then forwards the request with the server\u0027s `ACTUAL_GITHUB_TOKEN`, allowing any authenticated Actual user to read private GitHub resources reachable by that token. Version 26.7.0 fixes the issue.","datePublished":"Sep 25, 2026, 10:10:39 PM","dateUpdated":"Sep 28, 2026, 1:07:46 PM","status":"PUBLISHED","baseScore":7.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/actualbudget/actual/security/advisories/GHSA-m62c-5q34-f3cf\n","enisa_id":"EUVD-2026-87369\n","assigner":"GitHub_M","epss":0.26,"dataProcessed":"Nov 1, 2026, 7:17:36 AM","vulnerabilityProduct":[{"id":"6c47ee26-9c1b-38b0-aa06-e78cd0b6c77f","product":{"name":"actual","vendor":{"name":"actualbudget"}},"product_version":"\u003c 26.7.0"}],"vulnerabilityVendor":[{"id":"439bf138-49aa-3f3c-95d1-32f886a730a3","vendor":{"name":"actualbudget"}}]}},{"id":"4b372b47-450e-3fc3-8b0f-085908dbe2ec","vulnerability":{"id":"GHSA-m62c-5q34-f3cf","description":"Actual Sync Server: CORS Proxy GitHub API Allowlist Prefix Bypass Leaks Private Repositories Through the Server GitHub Token","datePublished":"Oct 7, 2026, 2:00:45 PM","dateUpdated":"Oct 7, 2026, 2:00:45 PM","baseScore":0.0,"references":"https://github.com/actualbudget/actual/security/advisories/GHSA-m62c-5q34-f3cf\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-57449\nhttps://github.com/actualbudget/actual\n","enisa_id":"EUVD-2026-87369\n","aliases":"GHSA-m62c-5q34-f3cf\nCVE-2026-57449\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:07:07 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}