Skip to main content

TaxHacker EUVDEUVD-2026-64626

| CVE-2026-78061 MEDIUM
Server-Side Request Forgery (SSRF) (CWE-918)
2026-08-23 VulDB GHSA-hrrq-qh5p-23c2
SSRF Taxhacker
5.3
CVSS 4.0 · Vendor: VulDB
Share

Severity by source

Vendor (VulDB) PRIMARY
5.3 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
6.4 MEDIUM

SSRF inherently changes scope (S:C) as the server reaches internal systems; PR:L required for authenticated access; no availability impact applies.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

2
Source Code Evidence Fetched
Aug 23, 2026 - 04:15 vuln.today
Analysis Generated
Aug 23, 2026 - 04:15 vuln.today

DescriptionCVE.org

A vulnerability was determined in vas3k TaxHacker up to 0.8.2. Impacted is the function buildImapConfig of the file lib/email-sync/imap-client.ts of the component Email Sync. Executing a manipulation of the argument host/port can lead to server-side request forgery. It is possible to launch the attack remotely. The pull request to fix this issue awaits acceptance.

AnalysisAI

Server-side request forgery in vas3k TaxHacker up to version 0.8.2 enables authenticated remote attackers to force the application server to initiate arbitrary IMAP TCP connections to attacker-controlled hosts and ports via the Email Sync configuration interface. The buildImapConfig function in lib/email-sync/imap-client.ts accepted unsanitized host and port parameters with no allowlist validation, no private-IP blocking, and no port restriction, allowing the TaxHacker server process to be redirected as a proxy into the internal network. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Authenticate to TaxHacker instance
Delivery
Navigate to Email Sync settings
Exploit
Submit crafted IMAP configuration with internal host and arbitrary port
Execution
Server calls buildImapConfig with unvalidated input
Persist
Server initiates TCP connection to internal target
Impact
Observe error/timing to map internal network topology
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires a valid authenticated user account on the TaxHacker instance with access to the Email Sync configuration interface (CVSS PR:L). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The reported CVSS 4.0 score of 5.3 (Medium) with vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N reflects network-accessible exploitation at low complexity but requiring authentication (PR:L). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An authenticated TaxHacker user submits an IMAP server configuration via the Email Sync settings page, setting `host` to an internal address such as 192.168.1.100 or 169.254.169.254 (AWS metadata endpoint) and `port` to a target service port such as 6379 (Redis), 22 (SSH), or 80 (internal HTTP). The server's `addEmailServerAction` passes these values unvalidated into `buildImapConfig` and calls `imaps.connect()`, directing a server-side TCP connection to the internal target. …
Remediation No released patched version is confirmed at time of analysis - the fix exists solely as unmerged GitHub PR #170 (https://github.com/vas3k/TaxHacker/pull/170). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Taxhacker

View all
CVE-2026-78062 MEDIUM
5.5 Aug 23

Authentication bypass in vas3k TaxHacker through version 0.8.2 is possible because the JWT Secret Handler in `lib/config

Same weakness CWE-918 – Server-Side Request Forgery (SSRF)

View all
CVE-2021-34473 CRITICAL POC
9.1
CVE-2021-26855 CRITICAL POC
9.1
CVE-2021-21985 CRITICAL POC
9.8
CVE-2022-41040 HIGH POC
8.8
CVE-2024-21893 HIGH POC
8.2
CVE-2021-40438 CRITICAL POC
9.0
CVE-2021-21975 HIGH POC
7.5
CVE-2023-48022 CRITICAL POC
9.8

Same technique SSRF

View all
CVE-2021-34473 CRITICAL POC
9.1
CVE-2021-26855 CRITICAL POC
9.1
CVE-2021-21985 CRITICAL POC
9.8
CVE-2024-21893 HIGH POC
8.2
CVE-2021-40438 CRITICAL POC
9.0
CVE-2021-21975 HIGH POC
7.5
CVE-2016-3718 MEDIUM POC
5.5
CVE-2026-15409 CRITICAL POC
10.0

Share

EUVD-2026-64626 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy