Homepage

@actual-app/sync-server@26.7.0-nightly.20260607

actual syncing server

  • latest version

    26.8.1

  • latest non vulnerable version

    26.9.0-nightly.20260809

  • first published

    1 years ago

  • latest version published

    2 days ago

  • licenses detected

  • View sync-server package health on Snyk  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the @actual-app/sync-server package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    Missing Authorization

    @actual-app/sync-server is an actual syncing server

    Affected versions of this package are vulnerable to Missing Authorization via the requireFileAccess check in the sync-server handlers for /delete-user-file, /reset-user-file, and /user-create-key. An attacker can delete, reset, or rekey another user’s hosted budget file by sending those endpoints a valid session and a file they only have shared user_access to. The affected code treats shared collaboration access as sufficient for owner-only management actions, so a non-owner collaborator can change the file’s deleted state, reset its sync metadata, or overwrite its encryption key. This lets a lower-privileged user perform destructive file-management operations on a file they do not own.

    Notes

    • The issue is limited to hosted-file management flow in sync-server and does not imply the broader collaboration endpoints that still rely on shared access for ordinary sync/upload/download operations.

    Workarounds

    • Restrict access to the sync-server file-management endpoints /delete-user-file, /reset-user-file, and /user-create-key so only file owners or admins can use them; this prevents shared user_access collaborators from deleting a hosted budget file, resetting its sync state, or rewriting its encryption key.

    How to fix Missing Authorization?

    Upgrade @actual-app/sync-server to version 26.7.0 or higher.

    <26.7.0
    Go back to all versions of this package