EUVD-2026-87369
GHSA-m62c-5q34-f3cf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to Actual Sync Server
-
DeliveryCraft GitHub API URL matching allowlisted /repos/{owner}/{repo} prefix
-
ExploitBypass startsWith() boundary check
-
ExecutionProxy attaches server ACTUAL_GITHUB_TOKEN
-
ImpactRead private GitHub resources reachable by token
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires all of: (1) the Actual Sync Server deployed with the ACTUAL_GITHUB_TOKEN environment variable configured (non-default operator choice), (2) at least one allowlisted public plugin repository whose /repos/{owner}/{repo} prefix can be abused, and (3) a valid authenticated Actual user account (PR:L) to reach the CORS proxy over the network. The impact is limited to private GitHub resources that the configured server token itself has permission to access - a low-scope token yields little, a broad token yields more. No user interaction is required. |
| Impact | This is a moderate, config-gated information-disclosure issue, not a top-tier priority. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H) scores 7.1 and correctly reflects an authenticated (PR:L) network attack with high confidentiality impact but zero integrity/availability impact and no subsequent-system scope (VI:N/VA:N/SC:N). No EPSS score, CISA KEV listing, or public exploit was provided in the intelligence, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The real-world risk is bounded by two strong limiters: exploitation requires an authenticated Actual user AND the server operator must have configured ACTUAL_GITHUB_TOKEN (a non-default deployment choice), and disclosure is confined to whatever GitHub resources that specific token can reach. Signals are internally consistent - a genuine but conditional confidentiality flaw rather than a high-CVSS-but-hollow finding - though its practical impact scales entirely with how privileged the configured GitHub token is. |
| Exploit ScenarioDerived | An operator runs a self-hosted Actual Sync Server with ACTUAL_GITHUB_TOKEN set for the plugin CORS proxy. An authenticated Actual user crafts a GitHub API URL whose path begins with the allowlisted prefix (e.g. /repos/acme/plugin...) but points at resources outside that public repo; the flawed startsWith() check passes it and the proxy forwards the request with the server's token, returning private GitHub data. No public exploit code was identified, but the flaw is trivially triggerable by anyone with a valid account. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 25, 2026
Information disclosure in Actual Sync Server versions prior to 26.7.0 allows an authenticated user (CVSS PR:L) to bypass the plugin CORS proxy allowlist and cause the server to attach its configured ACTUAL_GITHUB_TOKEN to GitHub API requests outside the permitted repository, exposing private GitHub resources that the token can reach. The flaw is a prefix-matching error: the allowlist check accepts any GitHub API path beginning with /repos/{owner}/{repo}, so sibling repositories sharing an allowlisted repository's name prefix pass validation. Exploitation is config-gated - it requires the operator to have set ACTUAL_GITHUB_TOKEN and to have at least one allowlisted public plugin repository - and impact is bounded by whatever permissions that token holds; no public exploit code was identified at time of analysis, and the vendor has released a fix in 26.7.0.
RemediationAI
Upgrade the Actual Sync Server to 26.7.0 or later, which the vendor ships as the fix for this advisory (Vendor-released patch: 26.7.0 per the GitHub security advisory GHSA-m62c-5q34-f3cf). Where an immediate upgrade is not possible, the most direct compensating control is to remove the ACTUAL_GITHUB_TOKEN environment variable from the Sync Server and restart it - the proxy then forwards unauthenticated requests and cannot leak the server's credentials, at the cost of losing token-assisted GitHub rate limits and access to private plugin sources, so only do this if the token is not functionally required. If the token must remain, replace it with a fine-grained, least-privilege token scoped to only the repositories actually needed; the blast radius is capped by the token's own permissions, so a narrow token meaningfully reduces exposure, though it does not close the underlying bypass. Additional hardening includes reviewing the plugin allowlist so no public repository name serves as a prefix for a more sensitive private repository, and restricting which accounts hold authenticated access to the Sync Server, since the proxy is reachable by any authenticated user (PR:L) - note this reduces the attacker pool but not the flaw itself. Confirm whether any unauthorized GitHub API calls were relayed through the proxy before patching, and rotate the token if exposure is suspected.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in npm, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Actual is a local-first personal finance tool whose Sync Server component exposes a CORS proxy so authenticated users can fetch plugin resources from repositories on an official allowlist. When the optional ACTUAL_GITHUB_TOKEN environment variable is configured, that proxy transparently adds the server's GitHub token to outbound GitHub requests. The validation logic for GitHub API URLs uses a raw startsWith() prefix test against /repos/{owner}/{repo} without requiring a path boundary (for example, a slash or end-of-string) after the repository name. Consequently, if https://github.com/acme/plugin is allowlisted, GitHub API paths such as /repos/acme/plugin-something/... also satisfy the check, letting an authenticated user direct the proxy - and the server's token - at repositories the allowlist was meant to exclude. This is a CWE-200 (Exposure of Sensitive Information) access-control/validation weakness rather than a code-execution or integrity bug: the confidentiality impact is high (VC:H) only because the leaked resources are private repositories, wiki data, or issue content readable by the configured token, while integrity and availability are unaffected (VI:N, VA:N). The vulnerability is entirely scoped to the Actual Sync Server deployment, not the desktop client, and only manifests when the non-default token configuration and an eligible allowlisted repository are both present.
Know when Node.js gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Authenticated Actual user (PR:L) sends the request over the network (AV:N/AC:L) with no interaction; impact is disclosure only (C:H, I:N/A:N), token-reachable data so scope unchanged.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
2DescriptionCVE.org
Actual is a local-first personal finance tool. Prior to 26.7.0, Actual Sync Server's CORS proxy is intended to let authenticated users fetch resources only from repositories listed in the official plugin allowlist. When ACTUAL_GITHUB_TOKEN is configured, the proxy automatically attaches the server's GitHub token to GitHub requests. The GitHub API allowlist check uses a raw startsWith() prefix test for /repos/{owner}/{repo} without requiring a path boundary after the repository name. If an allowlisted public plugin repository is https://github.com/acme/plugin, the proxy also accepts GitHub API URLs. Those URLs are outside the allowlisted repository but still pass because their API path starts with /repos/acme/plugin. The proxy then forwards the request with the server's ACTUAL_GITHUB_TOKEN, allowing any authenticated Actual user to read private GitHub resources reachable by that token. Version 26.7.0 fixes the issue.
Articles & Coverage 1
Technical POC Analysis
CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), classified by the advisory alongside CWE-284 and CWE-863.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
An information-disclosure flaw in Actual Sync Server (versions before 26.7.0) could let an authenticated user cause the server to release its configured GitHub access token to repositories outside the approved allowlist, potentially exposing private GitHub content that the token can reach. Impact is limited to deployments where an administrator has configured ACTUAL_GITHUB_TOKEN alongside at least one allowlisted public plugin repository, and the exposure is bounded by the permissions granted to that token. Leadership should care because a leaked or misused repository credential can expose proprietary source code or automation secrets, and remediation requires coordinated upgrade plus token rotation.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Remote code execution in n8n's workflow expression evaluation system allows an authenticated user with workflow creation
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
Exploit-DB