CVE-2026-57449 Overview
CVE-2026-57449 affects Actual, a local-first personal finance tool, in versions prior to 26.7.0. The vulnerability resides in the Actual Sync Server's CORS proxy, which is intended to restrict authenticated users to resources from repositories on the official plugin allowlist. The allowlist check uses a raw startsWith() prefix test for /repos/{owner}/{repo} without enforcing a path boundary. Authenticated Actual users can craft GitHub API URLs that bypass the check and are forwarded with the server's ACTUAL_GITHUB_TOKEN. This exposes private GitHub resources reachable by that token [CWE-200]. Version 26.7.0 fixes the issue.
Critical Impact
Authenticated Actual users can read private GitHub resources accessible to the server's configured ACTUAL_GITHUB_TOKEN by bypassing the CORS proxy allowlist.
Affected Products
- Actual Budget (actualbudget/actual) Sync Server prior to version 26.7.0
- Deployments with ACTUAL_GITHUB_TOKEN configured
- Self-hosted Actual Sync Server instances exposing the plugin CORS proxy
Discovery Timeline
- 2026-09-25 - CVE-2026-57449 published to NVD
- 2026-09-28 - Last updated in NVD database
Technical Details for CVE-2026-57449
Vulnerability Analysis
The Actual Sync Server exposes a CORS proxy that authenticated users invoke to fetch plugin resources from GitHub. When ACTUAL_GITHUB_TOKEN is set, the proxy automatically attaches that token to outbound GitHub API requests. The intent is to let the token authorize access only to repositories listed in the official plugin allowlist.
The allowlist check validates the requested GitHub API path with a startsWith() comparison against /repos/{owner}/{repo}. The check does not require a boundary character such as / after the repository name. As a result, any GitHub API path whose prefix matches an allowlisted repository string also passes.
For example, if the allowlist contains https://github.com/acme/plugin, the proxy accepts URLs whose API path begins with /repos/acme/plugin even when they resolve to a different repository or resource. The proxy then forwards the attacker-controlled request with the server's token attached, returning data the user should not reach.
Root Cause
The root cause is improper input validation in the allowlist comparison logic. A prefix-only startsWith() match without a trailing path separator check allows adjacent repository names and API paths to satisfy the check, violating the security boundary the allowlist is meant to enforce.
Attack Vector
Exploitation requires an authenticated Actual user and network access to the Sync Server's CORS proxy. The attacker crafts a GitHub API URL whose path begins with the string of an allowlisted repository but targets a different resource. The server attaches ACTUAL_GITHUB_TOKEN and returns the response, disclosing private repository contents reachable by that token. No user interaction is required beyond standard authenticated access. See the GitHub Security Advisory GHSA-m62c-5q34-f3cf for technical details.
Detection Methods for CVE-2026-57449
Indicators of Compromise
- CORS proxy requests to GitHub API paths that extend beyond allowlisted repository boundaries, for example /repos/acme/plugin-private or /repos/acme/plugin/../other.
- Outbound GitHub API calls from the Sync Server bearing ACTUAL_GITHUB_TOKEN to repositories not present on the plugin allowlist.
- Unexpected spikes in proxy traffic from a single authenticated Actual user.
Detection Strategies
- Review Actual Sync Server access logs for proxy requests whose target path begins with an allowlisted repository string but does not terminate at a / boundary.
- Correlate server-initiated GitHub API traffic with the configured plugin allowlist to identify requests referencing out-of-scope repositories.
- Audit GitHub token activity in GitHub's audit log to detect reads of private repositories the token should not have been used against.
Monitoring Recommendations
- Enable verbose logging for the Sync Server CORS proxy and forward logs to a centralized SIEM for correlation.
- Monitor GitHub organization audit logs for API calls authenticated by the Actual service token outside expected plugin repositories.
- Alert on any new or expanded scopes associated with ACTUAL_GITHUB_TOKEN.
How to Mitigate CVE-2026-57449
Immediate Actions Required
- Upgrade Actual Sync Server to version 26.7.0 or later, which enforces a path boundary after the repository name in the allowlist check.
- Rotate the ACTUAL_GITHUB_TOKEN after upgrading to invalidate any token exposure that may have occurred.
- Scope ACTUAL_GITHUB_TOKEN to the minimum permissions required for the plugin repositories only.
Patch Information
Actual version 26.7.0 fixes the vulnerability by correcting the allowlist comparison to require a path boundary after /repos/{owner}/{repo}. Users should upgrade immediately. Patch details are available in the GitHub Security Advisory GHSA-m62c-5q34-f3cf.
Workarounds
- Unset or remove the ACTUAL_GITHUB_TOKEN environment variable until the upgrade is applied, accepting reduced GitHub API rate limits for plugin fetches.
- Restrict network access to the Sync Server CORS proxy endpoint to trusted users only.
- Replace broad-scope GitHub tokens with fine-grained personal access tokens limited exclusively to the public plugin repositories on the allowlist.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
