CVE-2026-57449

Deferred Deferred - Pending Action

Actual Sync Server CORS Proxy GitHub Token Exposure

Publication date: 2026-09-25

Last updated on: 2026-09-28

Assigner: GitHub, Inc.

Description

Actual is a local-first personal finance tool. Prior to 26.7.0, Actual Sync Server's CORS proxy is intended to let authenticated users fetch resources only from repositories listed in the official plugin allowlist. When `ACTUAL_GITHUB_TOKEN` is configured, the proxy automatically attaches the server's GitHub token to GitHub requests. The GitHub API allowlist check uses a raw `startsWith()` prefix test for `/repos/{owner}/{repo}` without requiring a path boundary after the repository name. If an allowlisted public plugin repository is `https://github.com/acme/plugin`, the proxy also accepts GitHub API URLs. Those URLs are outside the allowlisted repository but still pass because their API path starts with `/repos/acme/plugin`. The proxy then forwards the request with the server's `ACTUAL_GITHUB_TOKEN`, allowing any authenticated Actual user to read private GitHub resources reachable by that token. Version 26.7.0 fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-28

Generated

2026-10-16

AI Q&A

2026-09-26

EPSS Evaluated

2026-10-14

NVD

CVE-2026-57449

EUVD

EUVD-2026-87369

Affected Vendors & Products

Vendor	Product	Version / Range
actual	actual	26.7.0
actual	actual_sync_server	to 26.7.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This vulnerability affects Actual Sync Server versions before 26.7.0. The CORS proxy is designed to restrict authenticated users to fetch resources only from allowlisted GitHub repositories. However, due to a flawed path check, it incorrectly allows requests to GitHub API endpoints that start with an allowlisted repository path. This lets users access private GitHub resources using the server's GitHub token.

Detection Guidance

To detect this vulnerability, check if your Actual Sync Server version is below 26.7.0. Verify if ACTUAL_GITHUB_TOKEN is configured and if the CORS proxy allows unintended GitHub API requests. Inspect proxy logs for requests to /repos/{owner}/{repo} paths that bypass repository allowlist checks.

Impact Analysis

If you use Actual Sync Server before version 26.7.0 with ACTUAL_GITHUB_TOKEN configured, any authenticated user could exploit this to read private GitHub resources accessible by the server's token. This includes sensitive data like private repositories, issues, or other restricted content.

Compliance Impact

This vulnerability could lead to unauthorized access to private GitHub resources via the CORS proxy, potentially exposing sensitive data. This may violate compliance requirements under GDPR (data protection) and HIPAA (health information privacy) if such data is mishandled or exposed.

Mitigation Strategies

Upgrade Actual Sync Server to version 26.7.0 or later to fix the CORS proxy allowlist bypass issue. Remove or restrict access to ACTUAL_GITHUB_TOKEN if configured to prevent unauthorized GitHub API access.

Hi! I’m here to help you understand CVE-2026-57449. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70