github-starred/actual
2
0
Fork 0
mirror of https://github.com/actualbudget/actual.git synced 2026-07-16 15:14:02 -05:00
Code Issues 3.0k Packages Projects Releases 58 Wiki Activity

[GH-ISSUE #5049] [Bug]: Electron embedded sync server overexposed to local network #71890

New Issue
Closed
opened 2026-05-16 11:39:12 -05:00 by GiteaMirror · 1 comment
GiteaMirror commented 2026-05-16 11:39:12 -05:00
Owner
Copy Link

Originally created by @ShreyasKallingal on GitHub (May 24, 2025).
Original GitHub issue: https://github.com/actualbudget/actual/issues/5049

Verified issue does not already exist?

  • I have searched and found no existing issue

What happened?

When running the electron app (mainline) with the embedded sync server enabled and configured via the GUI to use localhost:5007, the sync server unexpectedly binds to all interfaces (*.5007) instead of localhost.

This behavior exposes the app's sync data over HTTP to the entire local network, which is a security concern.

Cause:
The sync server default binding is to "::". startSyncServer passes on the port number from syncServerConfig, but I don't think the configured domain (localhost) is passed to start the server.

Suggested Fix:
Most direct fix would be to pass localhost as part of the sync server config. And maybe set a safer default for the domain. I'm happy to push a fix if you accept contributions.

How can we reproduce the issue?

Steps to Reproduce:

  1. Launch the electron app with the embedded sync server enabled.

  2. Set sync server to localhost:5007 in the GUI.

  3. Observe the server is listening on all interfaces:

❯ netstat -nat | grep 5007
tcp46      0      0  *.5007                 *.*                    LISTEN

Where are you hosting Actual?

Desktop App (Electron)

What browsers are you seeing the problem on?

No response

Operating System

Mac OSX

Originally created by @ShreyasKallingal on GitHub (May 24, 2025). Original GitHub issue: https://github.com/actualbudget/actual/issues/5049 ### Verified issue does not already exist? - [x] I have searched and found no existing issue ### What happened? When running the electron app (mainline) with the embedded sync server enabled and configured via the GUI to use localhost:5007, the sync server unexpectedly binds to all interfaces (*.5007) instead of localhost. This behavior exposes the app's sync data over HTTP to the entire local network, which is a security concern. Cause: The sync server default binding is to "::". `startSyncServer` passes on the port number from `syncServerConfig`, but I don't think the configured domain (localhost) is passed to start the server. Suggested Fix: Most direct fix would be to pass localhost as part of the sync server config. And maybe set a safer default for the domain. I'm happy to push a fix if you accept contributions. ### How can we reproduce the issue? Steps to Reproduce: 1. Launch the electron app with the embedded sync server enabled. 2. Set sync server to localhost:5007 in the GUI. 3. Observe the server is listening on all interfaces: ``` ❯ netstat -nat | grep 5007 tcp46 0 0 *.5007 *.* LISTEN ``` ### Where are you hosting Actual? Desktop App (Electron) ### What browsers are you seeing the problem on? _No response_ ### Operating System Mac OSX
GiteaMirror added the bug label 2026-05-16 11:39:12 -05:00
GiteaMirror commented 2026-05-16 11:39:15 -05:00
Author
Owner
Copy Link

@MikesGlitch commented on GitHub (May 27, 2025):

👋 Hey, thanks for reporting! Just has a look at your PR, would be happy to push for this to go in the next release if you can resolve the comments on it.

<!-- gh-comment-id:2912683813 --> @MikesGlitch commented on GitHub (May 27, 2025): 👋 Hey, thanks for reporting! Just has a look at your PR, would be happy to push for this to go in the next release if you can resolve the comments on it.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
AI generated
API
bank sync
budgeting
bug
can’t replicate
dependencies
docker
documentation
electron
experimental feature
feature
feedback
goal templates
good first issue
help wanted
importers
maintenance
needs info
needs testing
needs triage
needs votes
openid
payees
pull-request
Mirrored from GitHub Pull Request
 regression
reports
responsive
rules
schedules
server
✨ merged
split transactions
tech debt
tech-support
theme
transaction import
transaction reconciliation
transactions
translations
upstream
user interface
✅ approved
wontfix
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/actual#71890
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?