A missing authentication check on the ActualBudget server exposes the SimpleFIN and Pluggy.ai integration endpoints to any network user, allowing read access to sensitive bank account balances and transaction histories. The flaw is a classic missing authentication weakness (CWE‑306) and can result in the compromise of confidential financial data for all affected users.

The vulnerability affects the ActualBudget server component for all versions before 26.2.1 when the SimpleFIN or Pluggy.ai integrations are enabled. It applies to any instance reachable over a network, regardless of platform, and applies to all users that have these integrations configured.

The CVSS base score of 9.2 indicates critical severity. The EPSS score of less than 1% suggests a low general exploitation probability, yet the exposure is still serious because the attacker only needs network connectivity to the server. The vulnerability is not listed in the CISA KEV catalog, meaning it has not yet been reported as a known exploited vulnerability, but the lack of authentication provides an easy attack path for anyone who can reach the server from the internet or an internal network.