github-starred/actual
2
0
Fork 0
mirror of https://github.com/actualbudget/actual.git synced 2026-05-07 20:38:54 -05:00
Code Issues 1.6k Packages Projects Releases 55 Wiki Activity

[GH-ISSUE #3778] [Bug]: Able to download other users transaction info, even when they have end2end encryption enabled. #8500

New Issue
Closed
opened 2026-04-10 18:42:52 -05:00 by GiteaMirror · 4 comments
GiteaMirror commented 2026-04-10 18:42:52 -05:00
Owner
Copy Link

Originally created by @maxdalat on GitHub (Nov 3, 2024).
Original GitHub issue: https://github.com/actualbudget/actual/issues/3778

Verified issue does not already exist?

  • I have searched and found no existing issue
  • I will be providing steps how to reproduce the bug (in most cases this will also mean uploading a demo budget file)

What happened?

When I wanted to make a new account for someone, I tried to set up simplefin thinking that it would restart simplefin as if the other budget was separate. I found that instead, I was able to download all the transaction info, even when I didn't give my encryption key.

Where are you hosting Actual?

Docker

What browsers are you seeing the problem on?

Chrome

Operating System

Mac OSX

Originally created by @maxdalat on GitHub (Nov 3, 2024). Original GitHub issue: https://github.com/actualbudget/actual/issues/3778 ### Verified issue does not already exist? - [X] I have searched and found no existing issue - [X] I will be providing steps how to reproduce the bug (in most cases this will also mean uploading a demo budget file) ### What happened? When I wanted to make a new account for someone, I tried to set up simplefin thinking that it would restart simplefin as if the other budget was separate. I found that instead, I was able to download all the transaction info, even when I didn't give my encryption key. ### Where are you hosting Actual? Docker ### What browsers are you seeing the problem on? Chrome ### Operating System Mac OSX
GiteaMirror added the bug label 2026-04-10 18:42:52 -05:00
GiteaMirror commented 2026-04-10 18:42:53 -05:00
Author
Owner
Copy Link

@maxdalat commented on GitHub (Nov 4, 2024):

Oh what I meant by operating system, I was thinking about my laptop, sorry. In terms of docker, I am running it on a server with ubuntu 20.04 and have it connected through tailscale. I code through my laptop and open actual on my laptop. I was just thinking that this applies to any system so I didn't really think about what I put. Sorry about that confusion.

<!-- gh-comment-id:2453710128 --> @maxdalat commented on GitHub (Nov 4, 2024): Oh what I meant by operating system, I was thinking about my laptop, sorry. In terms of docker, I am running it on a server with ubuntu 20.04 and have it connected through tailscale. I code through my laptop and open actual on my laptop. I was just thinking that this applies to any system so I didn't really think about what I put. Sorry about that confusion.
GiteaMirror commented 2026-04-10 18:42:54 -05:00
Author
Owner
Copy Link

@youngcw commented on GitHub (Nov 4, 2024):

So you are seeing the other account's bank accounts in your simplefin account list? The file encryption key has nothing to do with simplefin, it only affects the budget files. If you want to have separate simplefin accounts you need to use different Actual servers and different simplefin accounts.

<!-- gh-comment-id:2454862952 --> @youngcw commented on GitHub (Nov 4, 2024): So you are seeing the other account's bank accounts in your simplefin account list? The file encryption key has nothing to do with simplefin, it only affects the budget files. If you want to have separate simplefin accounts you need to use different Actual servers and different simplefin accounts.
GiteaMirror commented 2026-04-10 18:42:54 -05:00
Author
Owner
Copy Link

@maxdalat commented on GitHub (Nov 4, 2024):

In actual documentation, it says that if you want to share the server with other people, you can set up separate budgets, and keep them separate by having encryption keys so that both need their own password. All I am asking for is a solution so that people who share a server, but have different budgets, are both able to implement simplefin completely separate from each other. I am trying to make different simplefin accounts, so that each person has their own subscription and key and everything is kept seperated. Lmk if you need any more clarification cause its kinda hard to explain.

<!-- gh-comment-id:2455445938 --> @maxdalat commented on GitHub (Nov 4, 2024): In actual documentation, it says that if you want to share the server with other people, you can set up separate budgets, and keep them separate by having encryption keys so that both need their own password. All I am asking for is a solution so that people who share a server, but have different budgets, are both able to implement simplefin completely separate from each other. I am trying to make different simplefin accounts, so that each person has their own subscription and key and everything is kept seperated. Lmk if you need any more clarification cause its kinda hard to explain.
GiteaMirror commented 2026-04-10 18:42:55 -05:00
Author
Owner
Copy Link

@youngcw commented on GitHub (Nov 4, 2024):

As of now there can only be one simplefin connection per server. So all budget files within a server can see all transaction data from simplefin. The docs you mention don't include bank syncing, just budget files.

There is ongoing work to add user support the the server which should make it so you can have separate simplefin credentials. On simpefin's side, there is no way to select just a subset of accounts, so you would need multiple simplefin accounts to not have access to each others data, and there isn't anything Actual can do about that.

For now, the only way to not see each others data and have separate bank syncing with simplefin, is to have separate servers and separate simplefin accounts.

<!-- gh-comment-id:2455454303 --> @youngcw commented on GitHub (Nov 4, 2024): As of now there can only be one simplefin connection per server. So all budget files within a server can see all transaction data from simplefin. The docs you mention don't include bank syncing, just budget files. There is ongoing work to add user support the the server which should make it so you can have separate simplefin credentials. On simpefin's side, there is no way to select just a subset of accounts, so you would need multiple simplefin accounts to not have access to each others data, and there isn't anything Actual can do about that. For now, the only way to not see each others data and have separate bank syncing with simplefin, is to have separate servers and separate simplefin accounts.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
AI generated
API
bank sync
budgeting
bug
can’t replicate
dependencies
docker
documentation
electron
experimental feature
feature
feedback
goal templates
good first issue
help wanted
importers
maintenance
needs info
needs testing
needs triage
needs votes
openid
payees
pull-request
Mirrored from GitHub Pull Request
 regression
reports
responsive
rules
schedules
server
✨ merged
split transactions
tech debt
theme
transaction import
transaction reconciliation
transactions
translations
upstream
user interface
✅ approved
wontfix
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/actual#8500
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?