actual
v26.11.0A local-first personal finance app
- Maintenance
- Active335 commits in 3 months · bus factor 5
- License
- MITPermissive · OSI-approved
- Security
- 15 advisories1 critical, 5 high, 8 medium, 1 low
- Supported versions
- No scheduleendoflife.date does not track this project
30.3k stars · 3.3k forks · 219 open issues · last release 13 days ago · data checked 2 hours ago
Security advisories
All advisories on GitHubThe 15 most recent advisories published by the maintainers: 1 critical, 5 high, 8 medium, 1 low. Check the patched version against the one you run.
- mediumGHSA-p7p2-pm6f-rg6xNov 2, 2026Electron enableNodeOptionsEnvironmentVariable fuse re-enabled allows NODE_OPTIONS code injection
- Affected
- >= 26.5.1, <= 26.10.0
- Patched in
- 26.11.0
- lowCVE-2026-57449Sep 23, 2026CORS Proxy GitHub API Allowlist Prefix Bypass Leaks Private Repositories Through the Server GitHub Token
- Affected
- <= 26.6.0
- Patched in
- >= 26.7.0
- highCVE-2026-50007Jun 12, 2026Shared users can perform owner-only file management actions
- Affected
- <= 26.4.0
- Patched in
- >= 26.7.0
- mediumCVE-2026-46700Jun 12, 2026Missing authorization on GET /secret/:name allows non-admin OpenID users to enumerate admin-configured bank-sync secrets
- Affected
- <= 26.5.2
- Patched in
- >= 26.6.0
- mediumCVE-2026-46672Jun 12, 2026CSV Formula Injection in `@actual-app/cli` `--format csv` Output via Custom `escapeCsv` Helper
- Affected
- <= 26.5.2
- Patched in
- >= 26.6.0
- mediumCVE-2026-50179Jun 12, 2026CSV Formula Injection in Transaction Export via Imported Payee/Notes Fields
- Affected
- <= 26.4.0
- Patched in
- >= 26.6.0
- highCVE-2026-49229Jun 12, 2026Disabled OpenID users keep access through existing session tokens
- Affected
- <= 26.5.2
- Patched in
- >= 26.6.0
- mediumCVE-2026-42890Jun 5, 2026Electron Run As Node in actual
- Affected
- < 26.5.0
- Patched in
- 26.5.0
- highCVE-2026-42604May 26, 2026OpenID `client_secret` Disclosure via Broken Authorization Guard in `/openid/config`
- Affected
- <= 26.4.0
- Patched in
- >= 26.5.0
- mediumCVE-2026-43872May 26, 2026Path traversal vulnerability in actual-server
- Affected
- <= 26.4.0
- Patched in
- >= 26.5.0
- highCVE-2026-33318Apr 23, 2026Privilege Escalation via 'change-password' Endpoint on OpenID-Migrated Servers
- Affected
- <=26.3.0
- Patched in
- >= 26.4.0
- mediumCVE-2026-3089Mar 7, 2026Actual Sync Server 26.2.1 - Authenticated Path Traversal
- Affected
- <= 26.2.0
- Patched in
- >= 26.3.0
- highCVE-2026-27638Feb 26, 2026Missing authorization in sync endpoints allows cross-user budget file access in multi-user mode
- Affected
- <= 26.2.0
- Patched in
- >= 26.2.1
- criticalCVE-2026-27584Feb 20, 2026Missing Authentication for SimpleFIN and Pluggy AI bank sync endpoints
- Affected
- <= 26.2.0
- Patched in
- >= 26.2.1
- mediumGHSA-xvp7-8vm8-xfxxOct 18, 2025Gocardless service is logging sensitive data including bearer tokens, account numbers, etc...
- Affected
- <= 25.10.0
- Patched in
- >= 25.11.0