CVE-2026-27584: 
JavaScript vulnerability analysis and mitigation

CVE-2026-27584 is a missing authentication vulnerability in the ActualBudget Server component (@actual-app/sync-server) that allows any unauthenticated network user to query the SimpleFIN and Pluggy.ai bank sync integration endpoints and read sensitive financial data. It affects all versions of @actual-app/sync-server prior to 26.2.1 (npm package). The vulnerability was reported by researcher iamsilk, published by maintainer MatissJanis on February 20, 2026, and assigned a CVE on February 24, 2026. It carries a CVSS v3.1 score of 7.5 (High) and a CVSS v4.0 score of 9.2 (Critical) (GitHub Advisory, ActualBudget Advisory).

The root cause is CWE-306 (Missing Authentication for Critical Function): the Express.js route handlers in app-simplefin.js and app-pluggyai.js omitted the validateSessionMiddleware that other integrations (e.g., GoCardless) correctly applied, leaving six POST endpoints — /simplefin/status, /simplefin/accounts, /simplefin/transactions, /pluggyai/status, /pluggyai/accounts, and /pluggyai/transactions — fully accessible without any session token or credentials. An attacker with network access to the ActualBudget Server instance can send unauthenticated HTTP POST requests directly to these endpoints to enumerate configured bank accounts and retrieve full transaction histories. No special tools, credentials, or complex setup are required; standard curl commands suffice (ActualBudget Advisory, Patch Commit).

Successful exploitation results in a high-severity confidentiality breach: an unauthenticated attacker can read bank account names, balances, currencies, and full transaction histories (including payee names, amounts, dates, and transaction notes) for all users who have configured SimpleFIN or Pluggy.ai integrations. There is no integrity or availability impact, but the exposed financial data could enable targeted fraud, social engineering, or identity theft. The scope is limited to the ActualBudget Server instance itself, but all users of that server instance with the affected integrations enabled are impacted (GitHub Advisory).

A proof-of-concept exploit consisting of simple curl commands is publicly documented in the official security advisory, requiring no authentication and only network reachability to the server (ActualBudget Advisory). There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported (Feedly). The EPSS score is approximately 0.135% (0.171% per GitHub Advisory), placing it in the 38th percentile for exploitation probability within 30 days. The vulnerability is not currently listed in the CISA KEV catalog.

1. Reconnaissance: Identify internet-facing or network-accessible ActualBudget Server instances running @actual-app/sync-server versions prior to 26.2.1 using tools like Shodan, Censys, or internal network scanning.
2. Check integration status: Send an unauthenticated POST request to determine if SimpleFIN or Pluggy.ai is configured:

   curl -X POST "https://<target>/simplefin/status"
   curl -X POST "https://<target>/pluggyai/status"

3. Enumerate bank accounts: If an integration is active, retrieve the list of linked bank accounts and their balances:

   curl -X POST "https://<target>/simplefin/accounts"
   curl -X POST "https://<target>/pluggyai/accounts"

4. Extract transaction history: Using an account ID obtained in the previous step, retrieve detailed transaction records:

   curl -X POST "https://<target>/simplefin/transactions" -H "Content-Type: application/json" -d '{"accountId":["ACT-XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX"],"startDate":["2026-01-01"]}'

5. Collect sensitive data: Parse the JSON responses to extract account names, balances, currencies, payee names, transaction amounts, and notes for all configured users (ActualBudget Advisory).

• Network: Unauthenticated HTTP POST requests to /simplefin/status, /simplefin/accounts, /simplefin/transactions, /pluggyai/status, /pluggyai/accounts, or /pluggyai/transactions from unexpected or external IP addresses.
• Network: Absence of a valid session cookie or authorization header in POST requests to the above endpoints (pre-patch behavior would still return 200 OK with data).
• Logs: ActualBudget Server access logs showing repeated POST requests to /simplefin/* or /pluggyai/* endpoints from IPs not associated with legitimate users, especially in rapid succession (automated scanning).
• Logs: Requests to the /simplefin/status or /pluggyai/status endpoints from IPs that have never previously authenticated to the server, which may indicate reconnaissance activity (ActualBudget Advisory).

The primary remediation is to upgrade @actual-app/sync-server to version 26.2.1 or later, which adds validateSessionMiddleware to all SimpleFIN and Pluggy.ai routes (Patch Commit, GitHub Advisory). If immediate patching is not possible, restrict network access to the ActualBudget Server using firewall rules or network segmentation so only trusted hosts can reach it. Additionally, consider disabling SimpleFIN and Pluggy.ai integrations if they are not actively in use until the patch can be applied.

The vulnerability was responsibly disclosed by researcher iamsilk and remediated by ActualBudget maintainer MatissJanis, who published the advisory and patch on February 20, 2026 (ActualBudget Advisory). No significant broader media coverage or notable external researcher commentary has been identified beyond the official advisory and standard CVE aggregator coverage.