Actual Sync-server Gocardless service is logging sensitive data including bearer tokens and account numbers

Summary

The GoCardless components in Actualbudget in are logging responses to STDOUT in a parsed format using console.logand console.debug (Which in this version of node is an alias for console.log). This is exposing sensitive information in log files including, but not limited to:

Gocardless bearer tokens.
Account IBAN and Bank Account numbers.
PII of the account holder.
Transaction details (Payee bank information, Recipient account numbers, Transaction IDs)...

Details

Whenever GoCardless responds to a request, the payload is printed to the debug log: https://github.com/actualbudget/actual/blob/36c40d90d2fe09eb1f25a6e2f77f6dd40638b267/packages/sync-server/src/app-gocardless/banks/integration-bank.js#L25-L27

This in turn logs the following information to Docker (all values removed here. These fields are possibly dependent on what is returned by each institution so may differ):

{
  &quot;account&quot;: {
    &quot;resourceId&quot;: &quot;&quot;,
    &quot;iban&quot;: &quot;&quot;,
    &quot;bban&quot;: &quot;&quot;,
    &quot;currency&quot;: &quot;&quot;,
    &quot;name&quot;: &quot;&lt;full legal name in the bank&gt;&quot;,
    &quot;product&quot;: &quot;&quot;,
    &quot;status&quot;: &quot;&quot;,
    &quot;bic&quot;: &quot;&quot;,
    &quot;usage&quot;: &quot;&quot;,
    &quot;id&quot;: &quot;&quot;,
    &quot;created&quot;: &quot;&quot;,
    &quot;last_accessed&quot;: &quot;&quot;,
    &quot;institution_id&quot;: &quot;&quot;,
    &quot;owner_name&quot;: &quot;&quot;,
    &quot;institution&quot;: {
      &quot;id&quot;: &quot;&quot;,
      &quot;name&quot;: &quot;&quot;,
      &quot;bic&quot;: &quot;&quot;,
      &quot;transaction_total_days&quot;: &quot;&quot;,
      &quot;countries&quot;: [
        &quot;&quot;
      ],
      &quot;logo&quot;: &quot;&quot;,
      &quot;max_access_valid_for_days&quot;: &quot;&quot;,
      &quot;supported_features&quot;: [
        &quot;&quot;,
        &quot;&quot;,
        &quot;&quot;
      ],
      &quot;identification_codes&quot;: []
    }
  }
}

https://github.com/actualbudget/actual/blob/36c40d90d2fe09eb1f25a6e2f77f6dd40638b267/packages/sync-server/src/app-gocardless/banks/integration-bank.js#L83-L85

This is the first of the 10 transactions:

{
  &quot;top10Transactions&quot;: [{
    &quot;transactionId&quot;: &quot;&quot;,
    &quot;entryReference&quot;: &quot;&quot;,
    &quot;bookingDate&quot;: &quot;&quot;,
    &quot;valueDate&quot;: &quot;&quot;,
    &quot;transactionAmount&quot;: {
      &quot;amount&quot;: &quot;&quot;,
      &quot;currency&quot;: &quot;&quot;
    },
    &quot;creditorName&quot;: &quot;&quot;,
    &quot;creditorAccount&quot;: {
      &quot;bban&quot;: &quot;&quot;
    },
    &quot;debtorName&quot;: &quot;&quot;,
    &quot;debtorAccount&quot;: {
      &quot;bban&quot;: &quot;&quot;
    },
    &quot;remittanceInformationUnstructured&quot;: &quot;&quot;,
    &quot;remittanceInformationStructuredArray&quot;: [
      {&quot;reference&quot;: &quot;&quot;, &quot;referenceType&quot;: &quot;&quot;}
    ],
    &quot;additionalInformation&quot;: &quot;&quot;,
    &quot;proprietaryBankTransactionCode&quot;: &quot;&quot;,
    &quot;debtorAgent&quot;: &quot;&quot;,
    &quot;internalTransactionId&quot;: &quot;&quot;,
    &quot;payeeName&quot;: &quot;&quot;,
    &quot;date&quot;: &quot;&quot;
  }]
}

Additionally, in the error handling for GoCardless, there is a catch all for unclassified errors that prints the entire stack trace to the console.

https://github.com/actualbudget/actual/blob/36c40d90d2fe09eb1f25a6e2f77f6dd40638b267/packages/sync-server/src/app-gocardless/app-gocardless.js#L263-L264

Our bank was offline today for maintenance which threw a 503 error from Gocardless. The entire response payload was dumped to console, which includes the Bearer tokens for accessing GoCardless:

Something went wrong ServiceError: Institution service unavailable
    at handleGoCardlessError (file:///app/src/app-gocardless/services/gocardless-service.js:59:13)
    at Object.getTransactions (file:///app/src/app-gocardless/services/gocardless-service.js:530:7)
    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
    at async Object.getNormalizedTransactions (file:///app/src/app-gocardless/services/gocardless-service.js:267:26)
    at async file:///app/src/app-gocardless/app-gocardless.js:186:13 {
  details: h [AxiosError]: Request failed with status code 503
      at te (file:///app/node_modules/nordigen-node/dist/index.esm.js:13:914)
      at IncomingMessage.&lt;anonymous&gt; (file:///app/node_modules/nordigen-node/dist/index.esm.js:17:16315)
      at IncomingMessage.emit (node:events:529:35)
      at endReadableNT (node:internal/streams/readable:1400:12)
      at process.processTicksAndRejections (node:internal/process/task_queues:82:21) {
    code: &#039;ERR_BAD_RESPONSE&#039;,
    config: {
      transitional: {
        silentJSONParsing: true,
        forcedJSONParsing: true,
        clarifyTimeoutError: false
      },
      adapter: [ &#039;xhr&#039;, &#039;http&#039; ],
      transformRequest: [ [Function (anonymous)] ],
      transformResponse: [ [Function (anonymous)] ],
      timeout: 0,
      xsrfCookieName: &#039;XSRF-TOKEN&#039;,
      xsrfHeaderName: &#039;X-XSRF-TOKEN&#039;,
      maxContentLength: -1,
      maxBodyLength: -1,
      env: {
        FormData: [Function: _] {
          LINE_BREAK: &#039;\r\n&#039;,
          DEFAULT_CONTENT_TYPE: &#039;application/octet-stream&#039;
        },
        Blob: [class Blob]
      },
      validateStatus: [Function: validateStatus],
      headers: T [AxiosHeaders] {
        Accept: &#039;application/json&#039;,
        &#039;Content-Type&#039;: &#039;application/json&#039;,
        &#039;User-Agent&#039;: &#039;Nordigen-Node-v2&#039;,
        &#039;Authorization&#039;: &#039;Bearer eyJ0eXAi... (the full token is in the response)&#039;,
        &#039;Accept-Encoding&#039;: &#039;gzip, compress, deflate, br&#039;
      },
      method: &#039;get&#039;,
      url: URL {
        href: &#039;https://bankaccountdata.gocardless.com/api/v2/accounts/&lt;Account id Was Here&gt;?date_from=2024-12-22&#039;,
        origin: &#039;https://bankaccountdata.gocardless.com&#039;,
        protocol: &#039;https:&#039;,
        username: &#039;&#039;,
        password: &#039;&#039;,
        host: &#039;bankaccountdata.gocardless.com&#039;,
        hostname: &#039;bankaccountdata.gocardless.com&#039;,
        port: &#039;&#039;,
        pathname: &#039;/api/v2/accounts/&lt;Account id Was Here&gt;/transactions&#039;,
        search: &#039;?date_from=2024-12-22&#039;,
        searchParams: URLSearchParams { &#039;date_from&#039; =&gt; &#039;2024-12-22&#039; },
        hash: &#039;&#039;
      },
      data: undefined
    },

And quite a few pages more.

PoC

Setup an Actualbudget server inside of Docker. In this instance I was using the Docker Compose script posted in the repository: https://github.com/actualbudget/actual/blob/master/packages/sync-server/docker-compose.yml
Link a gocardless account to Actualbudget and sync a bank account
Observe in the container using docker logs actual-actual_server-1 -f that sensitive details are logged to the console and ingested by docker.

Impact

Information disclosure. The services are available both on-premises and in environments that are not under the control of the end user, such as third-party providers who offer this application as a managed solution.

Published: Oct 20, 2025
Updated: Oct 21, 2025
GHSA: GHSA-xvp7-8vm8-xfxx
Severity: Medium
Exploit:

CVSS v3:

Severity: Unknown
Score:
AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N

CWEs:

OWASP TOP 10:

A6 - Security Misconfiguration

Affected Software
References

Software	From	Fixed in
@actual-app / sync-server	-	25.10.0.x

Vulnerability Database

Actual Sync-server Gocardless service is logging sensitive data including bearer tokens and account numbers

Summary

Details

PoC

Impact

Deep Security Visibility Without the Complexity