{"action":"Upgrade @actual-app/sync-server to 26.2.1 or later.","affected":[{"fixed":"26.2.1","introduced":"0"}],"component":"@actual-app/sync-server","cve_ids":["CVE-2026-27638"],"ecosystem":"npm","epss":0.00343,"exploited":false,"fixed_versions":["26.2.1"],"ghsa_id":"GHSA-qmjj-p7m9-wjrv","id":"tcs_01M5KG6JHKGAE1PATVJJWHW4K6","modified_at":"2026-02-28T05:56:20.442461Z","published_at":"2026-02-27T19:29:46Z","references":["https://osv.dev/vulnerability/GHSA-qmjj-p7m9-wjrv","https://github.com/actualbudget/actual/security/advisories/GHSA-qmjj-p7m9-wjrv","https://nvd.nist.gov/vuln/detail/CVE-2026-27638","https://github.com/actualbudget/actual/commit/9966c024cb75f57943193cac8e42f401efed9d08","https://github.com/actualbudget/actual","https://github.com/actualbudget/actual/releases/tag/v26.2.1"],"severity":{"label":"high","score":7.1},"sources":[{"source":"osv","source_id":"GHSA-qmjj-p7m9-wjrv","url":"https://osv.dev/vulnerability/GHSA-qmjj-p7m9-wjrv"},{"source":"nvd","source_id":"CVE-2026-27638","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27638"}],"summary":"@actual-app/sync-server: Missing authorization in sync endpoints allows cross-user budget file access in multi-user mode"}