Security readout for executives and security teams
Plain-English summary
CVE-2026-27638 affects Actual Budget servers running multi-user mode with OpenID before version 26.2.1. A logged-in user could access or overwrite another user’s budget file if they know or obtain its file ID. This is not anonymous internet compromise, but it is serious for shared or hosted deployments because personal financial data integrity is at risk.
Executive priority
Treat as a near-term fix for any shared Actual Budget deployment. The vulnerability can affect private financial records and file integrity, but requires authenticated access and has a vendor patch available. Upgrade before onboarding additional users or exposing multi-user service to broader audiences.
Technical view
Actual’s /sync/* API endpoints lacked authorization checks tying the authenticated user to the requested budget file. In affected versions before 26.2.1, any authenticated user in multi-user OpenID mode could operate on another user’s file ID, enabling unauthorized read, modification, or overwrite. The issue is classified as CWE-862, Missing Authorization, with CVSS 4.0 score 5.7.
Likely exposure
Exposure is limited to Actual Budget deployments using multi-user mode with OpenID authentication and versions earlier than 26.2.1. Single-user deployments are not identified as affected in the provided sources. Internet-facing hosted instances with multiple users have higher practical risk.
Exploitation context
The source bundle does not indicate known active exploitation, and the CVE is not listed as KEV. Exploitation requires authenticated access and a target file ID. The main risk is cross-user access inside a shared Actual instance, especially where untrusted or loosely managed users share the same service.
Researcher notes
The key condition is missing object-level authorization on sync endpoints. Validate by code review or safe authorization testing in a controlled environment, without accessing real user data. Sources identify the patch commit and v26.2.1 release, but do not provide evidence of active exploitation.
Mitigation direction
- Upgrade Actual Budget to version 26.2.1 or later.
- Prioritize multi-user OpenID deployments, especially shared or hosted instances.
- Review vendor advisory and release notes before applying changes.
- Restrict user access until upgraded if the instance has untrusted users.
Validation and detection
- Inventory Actual Budget servers and record deployed versions.
- Confirm whether multi-user OpenID mode is enabled.
- Verify affected systems are upgraded to 26.2.1 or later.
- Review logs for unusual cross-user sync activity where available.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-862: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-27638 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.7 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
5.7MediumVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/actualbudget/actual/security/advisories/GHSA-qmjj-p7m9-wjrvCVE reference · x_refsource_CONFIRM
- https://github.com/actualbudget/actual/commit/9966c024cb75f57943193cac8e42f401efed9d08CVE reference · x_refsource_MISC
- https://github.com/actualbudget/actual/releases/tag/v26.2.1CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Authorization
Missing Authorization represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.