CVE-2026-57449: Actual Sync Server: CORS Proxy GitHub API Allowlist Prefix Bypass Leaks Private Repositories Through the Server GitHub Token
Actual is a local-first personal finance tool. Prior to 26.7.0, Actual Sync Server's CORS proxy is intended to let authenticated users fetch resources only from repositories listed in the official plugin allowlist. When ACTUALGITHUBTOKEN is configured, the proxy automatically attaches the server's GitHub token to GitHub requests. The GitHub API allowlist check uses a raw startsWith() prefix test for /repos/{owner}/{repo} without requiring a path boundary after the repository name. If an allowlisted public plugin repository is https://github.com/acme/plugin, the proxy also accepts GitHub API URLs. Those URLs are outside the allowlisted repository but still pass because their API path starts with /repos/acme/plugin. The proxy then forwards the request with the server's ACTUALGITHUBTOKEN, allowing any authenticated Actual user to read private GitHub resources reachable by that token. Version 26.7.0 fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Actual Sync Serverto a version that resolves this vulnerability.Fixed in 26.7.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Actual Sync Server deployments earlier than 26.7.0 are exposed when ACTUAL_GITHUB_TOKEN is configured and authenticated users can access the CORS proxy. The impact is limited to GitHub resources that the configured token can read.
What does an attacker need to exploit it?
An attacker needs to be an authenticated Actual user and must submit a GitHub API URL whose path begins with an allowlisted repository path but targets a different resource. The server then forwards that request with its configured GitHub token.
Are deployments without a GitHub token affected by the private-repository disclosure?
The described private-resource disclosure depends on ACTUAL_GITHUB_TOKEN being configured, because the proxy attaches that server token to GitHub requests. Without that token, the described token-based access to private GitHub resources is not available.
What should be done if an immediate upgrade is not possible?
Remove or disable ACTUAL_GITHUB_TOKEN from the Sync Server to prevent the proxy from forwarding GitHub requests with the server's token. Also restrict access to authenticated Actual users until the server can be upgraded to 26.7.0.
How can I determine whether the server needs remediation?
Check whether the Sync Server version is earlier than 26.7.0 and whether ACTUAL_GITHUB_TOKEN is configured. If both conditions apply, assess which private GitHub resources that token can read, as those resources may have been accessible to authenticated users.