Actual Sync Server’s CORS proxy was designed to forward requests only to repositories that appear on an allowlist. The server applies legacy string matching that checks whether the requested API path starts with the repository prefix but does not enforce a path boundary. As a result, an attacker can target GitHub API URLs that partially match an allowlisted public repository and the proxy forwards those requests with a server‑side ACTUAL_GITHUB_TOKEN. Any authenticated user of the sync server can thus read private repositories belonging to the token holder, violating confidentiality.

The vulnerability affects all installations of Actual budget Actual running version 26.6.0 and older. Upstream plugins from public repositories that start with an allowlisted owner/repo pair are the source for the bypass, but the impact is limited to any server that has a configured ACTUAL_GITHUB_TOKEN.

With a CVSS score of 7.1 the vulnerability is considered high severity. The EPSS score is currently unknown, and it is not listed in CISA’s KEV catalog. An authorized user can exploit the bug by simply sending a request through the sync server’s CORS proxy with a target GitHub API URL that satisfies the prefix rule; no additional privileges are required beyond normal operating access to the server. Because the server’s GitHub token is automatically attached, the attacker gains read access to private repositories that the token is entitled to.