Actual Sync Server CVE-2026-57449

Exploitation requires all of: (1) the Actual Sync Server deployed with the ACTUAL_GITHUB_TOKEN environment variable configured (non-default operator choice), (2) at least one allowlisted public plugin repository whose /repos/{owner}/{repo} prefix can be abused, and (3) a valid authenticated Actual user account (PR:L) to reach the CORS proxy over the network. The impact is limited to private GitHub resources that the configured server token itself has permission to access - a low-scope token yields little, a broad token yields more. No user interaction is required.

This is a moderate, config-gated information-disclosure issue, not a top-tier priority. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H) scores 7.1 and correctly reflects an authenticated (PR:L) network attack with high confidentiality impact but zero integrity/availability impact and no subsequent-system scope (VI:N/VA:N/SC:N). No EPSS score, CISA KEV listing, or public exploit was provided in the intelligence, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The real-world risk is bounded by two strong limiters: exploitation requires an authenticated Actual user AND the server operator must have configured ACTUAL_GITHUB_TOKEN (a non-default deployment choice), and disclosure is confined to whatever GitHub resources that specific token can reach. Signals are internally consistent - a genuine but conditional confidentiality flaw rather than a high-CVSS-but-hollow finding - though its practical impact scales entirely with how privileged the configured GitHub token is.

An operator runs a self-hosted Actual Sync Server with ACTUAL_GITHUB_TOKEN set for the plugin CORS proxy. An authenticated Actual user crafts a GitHub API URL whose path begins with the allowlisted prefix (e.g. /repos/acme/plugin...) but points at resources outside that public repo; the flawed startsWith() check passes it and the proxy forwards the request with the server's token, returning private GitHub data. No public exploit code was identified, but the flaw is trivially triggerable by anyone with a valid account.