TaxHacker EUVD-2026-64626

Exploitation requires a valid authenticated user account on the TaxHacker instance with access to the Email Sync configuration interface (CVSS PR:L). The vulnerable code path is only reachable via the addEmailServerAction or updateEmailServerAction server actions in app/(app)/apps/email/actions.ts - the attacker must be able to submit or update an IMAP server configuration. The Email Sync feature must be accessible to the attacker's account; instances that restrict this feature or have no user accounts exposed to untrusted parties are not directly exploitable. Exploitation is bounded by the network reachability of the TaxHacker server process: if outbound egress is filtered to block RFC 1918 and link-local destinations, internal pivoting is prevented even without a code patch. No special IMAP configuration or non-default application mode is required beyond having the Email Sync feature available.

The reported CVSS 4.0 score of 5.3 (Medium) with vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N reflects network-accessible exploitation at low complexity but requiring authentication (PR:L). The vendor-reported vector rates SC:N/SI:N/SA:N - no subsequent system impact - which conflicts with the inherent nature of SSRF, where the server's outbound connectivity is redirected to internal resources. This is likely an underassessment: SSRF via IMAP's TCP connection model enables port scanning of internal hosts and potential interaction with cleartext internal services (Redis, internal HTTP APIs, cloud metadata endpoints such as AWS IMDSv1 at 169.254.169.254). EPSS data is not provided, making opportunistic exploitation probability unknown. KEV status is not confirmed and no public exploit code has been identified. Real-world risk is constrained by the PR:L requirement - exploitation demands a valid TaxHacker account - and is further reduced for deployments with strict egress firewall rules blocking RFC 1918 outbound traffic. The patch PR is unmerged, meaning no released fixed version exists at time of analysis; this is a notable gap for self-hosted operators.

An authenticated TaxHacker user submits an IMAP server configuration via the Email Sync settings page, setting host to an internal address such as 192.168.1.100 or 169.254.169.254 (AWS metadata endpoint) and port to a target service port such as 6379 (Redis), 22 (SSH), or 80 (internal HTTP). The server's addEmailServerAction passes these values unvalidated into buildImapConfig and calls imaps.connect(), directing a server-side TCP connection to the internal target. Connection success, failure, or response timing in error messages exposes open/closed port status, enabling systematic internal network reconnaissance from the attacker's authenticated session.