A vulnerability described as problematic has been identified in actualbudget actual up to 26.2.0. This affects an unknown function of the file /sync/ of the component Sync API Endpoint. Executing a manipulation can lead to missing authorization.
This vulnerability is handled as CVE-2026-27638. It is possible to launch the attack on the local host. There is not any exploit available.
Upgrading the affected component is recommended.
