CVE-2026-78061

Medium

Description

A vulnerability was determined in vas3k TaxHacker up to 0.8.2. Impacted is the function buildImapConfig of the file lib/email-sync/imap-client.ts of the component Email Sync. Executing a manipulation of the argument host/port can lead to server-side request forgery. It is possible to launch the attack remotely. The pull request to fix this issue awaits acceptance.

SeverityMedium

CVSS6.3

Exploit probability—

ProductVas3k Taxhacker

PublishedAug 23, 2026

First seenAug 23, 2026

Weakness typeCWE-918Server-side request forgery (SSRF)

How to fix

Patches

github.com/vas3k/TaxHacker/pull/170

Affected products

Product	Affected versions	Fixed in
vas3k taxhacker	0.8.0, 0.8.1, 0.8.2	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.