{"action":"Upgrade @actual-app/sync-server to 25.11.0 or later.","affected":[{"fixed":"25.11.0","introduced":"0"}],"component":"@actual-app/sync-server","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":["25.11.0"],"ghsa_id":"GHSA-xvp7-8vm8-xfxx","id":"tcs_01M5KGJZQX7XMFNJ1GT9WTSGA8","modified_at":"2026-09-10T03:50:30.379264788Z","published_at":"2025-10-20T17:55:59Z","references":["https://osv.dev/vulnerability/GHSA-xvp7-8vm8-xfxx","https://github.com/actualbudget/actual/security/advisories/GHSA-xvp7-8vm8-xfxx","https://github.com/actualbudget/actual/commit/97482a082d502887ef22514b93e35e4c67f4f30f","https://github.com/actualbudget/actual","https://github.com/actualbudget/actual/blob/36c40d90d2fe09eb1f25a6e2f77f6dd40638b267/packages/sync-server/src/app-gocardless/app-gocardless.js#L263-L264","https://github.com/actualbudget/actual/blob/36c40d90d2fe09eb1f25a6e2f77f6dd40638b267/packages/sync-server/src/app-gocardless/banks/integration-bank.js#L25-L27","https://github.com/actualbudget/actual/blob/36c40d90d2fe09eb1f25a6e2f77f6dd40638b267/packages/sync-server/src/app-gocardless/banks/integration-bank.js#L83-L85"],"severity":{"label":"medium","score":4.2},"sources":[{"source":"osv","source_id":"GHSA-xvp7-8vm8-xfxx","url":"https://osv.dev/vulnerability/GHSA-xvp7-8vm8-xfxx"}],"summary":"Actual Sync-server Gocardless service is logging sensitive data including bearer tokens and account numbers"}