actualbudget Actual up to 26.6.x CORS Proxy startsWith cross-domain policy

Summaryinfo

A vulnerability classified as problematic has been found in actualbudget Actual up to 26.6.x. The affected element is the function startsWith of the component CORS Proxy. Performing a manipulation results in cross-domain policy. This vulnerability was named CVE-2026-57449. The attack may be initiated remotely. There is no available exploit. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in actualbudget Actual up to 26.6.x. This affects the function startsWith of the component CORS Proxy. The manipulation with an unknown input leads to a cross-domain policy vulnerability. CWE is classifying the issue as CWE-942. The product uses a cross-domain policy file that includes domains that should not be trusted. This is going to have an impact on confidentiality. The summary by CVE is:

Actual is a local-first personal finance tool. Prior to 26.7.0, Actual Sync Server's CORS proxy is intended to let authenticated users fetch resources only from repositories listed in the official plugin allowlist. When `ACTUAL_GITHUB_TOKEN` is configured, the proxy automatically attaches the server's GitHub token to GitHub requests. The GitHub API allowlist check uses a raw `startsWith()` prefix test for `/repos/{owner}/{repo}` without requiring a path boundary after the repository name. If an allowlisted public plugin repository is `https://github.com/acme/plugin`, the proxy also accepts GitHub API URLs. Those URLs are outside the allowlisted repository but still pass because their API path starts with `/repos/acme/plugin`. The proxy then forwards the request with the server's `ACTUAL_GITHUB_TOKEN`, allowing any authenticated Actual user to read private GitHub resources reachable by that token. Version 26.7.0 fixes the issue.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-57449 since 06/24/2026. The exploitability is told to be difficult. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available.

Upgrading to version 26.7.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-87369). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• actualbudget

Name

• Actual

Version

• 26.0
• 26.1
• 26.2
• 26.3
• 26.4
• 26.5
• 26.6

Website

• Product: https://github.com/actualbudget/actual/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion