[Bug]: Able to download other users transaction info, even when they have end2end encryption enabled. #1561

New Issue

GiteaMirror · 2026-02-28T19:47:13-06:00

GiteaMirror commented

2026-02-28 19:47:13 -06:00

Originally created by @maxdalat on GitHub (Nov 3, 2024).

Verified issue does not already exist?

I have searched and found no existing issue
I will be providing steps how to reproduce the bug (in most cases this will also mean uploading a demo budget file)

What happened?

When I wanted to make a new account for someone, I tried to set up simplefin thinking that it would restart simplefin as if the other budget was separate. I found that instead, I was able to download all the transaction info, even when I didn't give my encryption key.

Where are you hosting Actual?

Docker

What browsers are you seeing the problem on?

Chrome

Operating System

Mac OSX

Originally created by @maxdalat on GitHub (Nov 3, 2024). ### Verified issue does not already exist? - [X] I have searched and found no existing issue - [X] I will be providing steps how to reproduce the bug (in most cases this will also mean uploading a demo budget file) ### What happened? When I wanted to make a new account for someone, I tried to set up simplefin thinking that it would restart simplefin as if the other budget was separate. I found that instead, I was able to download all the transaction info, even when I didn't give my encryption key. ### Where are you hosting Actual? Docker ### What browsers are you seeing the problem on? Chrome ### Operating System Mac OSX

GiteaMirror added the bug label 2026-02-28 19:47:13 -06:00

GiteaMirror closed this issue

2026-02-28 19:47:13 -06:00

GiteaMirror commented

2026-02-28 19:47:14 -06:00

@maxdalat commented on GitHub (Nov 4, 2024):

Oh what I meant by operating system, I was thinking about my laptop, sorry. In terms of docker, I am running it on a server with ubuntu 20.04 and have it connected through tailscale. I code through my laptop and open actual on my laptop. I was just thinking that this applies to any system so I didn't really think about what I put. Sorry about that confusion.

@maxdalat commented on GitHub (Nov 4, 2024): Oh what I meant by operating system, I was thinking about my laptop, sorry. In terms of docker, I am running it on a server with ubuntu 20.04 and have it connected through tailscale. I code through my laptop and open actual on my laptop. I was just thinking that this applies to any system so I didn't really think about what I put. Sorry about that confusion.

GiteaMirror commented

2026-02-28 19:47:14 -06:00

@youngcw commented on GitHub (Nov 4, 2024):

So you are seeing the other account's bank accounts in your simplefin account list? The file encryption key has nothing to do with simplefin, it only affects the budget files. If you want to have separate simplefin accounts you need to use different Actual servers and different simplefin accounts.

@youngcw commented on GitHub (Nov 4, 2024): So you are seeing the other account's bank accounts in your simplefin account list? The file encryption key has nothing to do with simplefin, it only affects the budget files. If you want to have separate simplefin accounts you need to use different Actual servers and different simplefin accounts.

GiteaMirror commented

2026-02-28 19:47:14 -06:00

@maxdalat commented on GitHub (Nov 4, 2024):

In actual documentation, it says that if you want to share the server with other people, you can set up separate budgets, and keep them separate by having encryption keys so that both need their own password. All I am asking for is a solution so that people who share a server, but have different budgets, are both able to implement simplefin completely separate from each other. I am trying to make different simplefin accounts, so that each person has their own subscription and key and everything is kept seperated. Lmk if you need any more clarification cause its kinda hard to explain.

@maxdalat commented on GitHub (Nov 4, 2024): In actual documentation, it says that if you want to share the server with other people, you can set up separate budgets, and keep them separate by having encryption keys so that both need their own password. All I am asking for is a solution so that people who share a server, but have different budgets, are both able to implement simplefin completely separate from each other. I am trying to make different simplefin accounts, so that each person has their own subscription and key and everything is kept seperated. Lmk if you need any more clarification cause its kinda hard to explain.

GiteaMirror commented

2026-02-28 19:47:15 -06:00

@youngcw commented on GitHub (Nov 4, 2024):

As of now there can only be one simplefin connection per server. So all budget files within a server can see all transaction data from simplefin. The docs you mention don't include bank syncing, just budget files.

There is ongoing work to add user support the the server which should make it so you can have separate simplefin credentials. On simpefin's side, there is no way to select just a subset of accounts, so you would need multiple simplefin accounts to not have access to each others data, and there isn't anything Actual can do about that.

For now, the only way to not see each others data and have separate bank syncing with simplefin, is to have separate servers and separate simplefin accounts.

@youngcw commented on GitHub (Nov 4, 2024): As of now there can only be one simplefin connection per server. So all budget files within a server can see all transaction data from simplefin. The docs you mention don't include bank syncing, just budget files. There is ongoing work to add user support the the server which should make it so you can have separate simplefin credentials. On simpefin's side, there is no way to select just a subset of accounts, so you would need multiple simplefin accounts to not have access to each others data, and there isn't anything Actual can do about that. For now, the only way to not see each others data and have separate bank syncing with simplefin, is to have separate servers and separate simplefin accounts.