CVE-2026-78061: Server-Side Request Forgery in vas3k TaxHacker
CVE-2026-78061 is a server-side request forgery (SSRF) vulnerability in vas3k TaxHacker versions 0.8.0, 0.8.1, and 0.8.2. The flaw exists in the buildImapConfig function within the Email Sync component, where manipulation of the host or port arguments can lead to SSRF. This vulnerability can be exploited remotely. A patch has been developed but is pending acceptance. The product is a cloud service, so remediation may be managed by the vendor.
AI Analysis
Technical Summary
This vulnerability affects the buildImapConfig function in the lib/email-sync/imap-client.ts file of vas3k TaxHacker up to version 0.8.2. By manipulating the host or port parameters, an attacker can trigger server-side request forgery, potentially causing the server to make unintended requests. The vulnerability is remotely exploitable. A fix has been created but is awaiting acceptance. The product is cloud-hosted, which typically means the vendor manages patch deployment.
Potential Impact
Successful exploitation allows an attacker to induce the server to make arbitrary requests, which may lead to information disclosure or interaction with internal systems not otherwise accessible. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low complexity, no user interaction, and limited impact on confidentiality, integrity, and availability.
Mitigation Recommendations
A patch is available but currently pending acceptance. Since TaxHacker is a cloud service, the vendor likely manages remediation server-side. Users should monitor vendor advisories for patch deployment status and apply updates once the fix is accepted and released. No other vendor-provided mitigations are currently documented.
CVE-2026-78061: Server-Side Request Forgery in vas3k TaxHacker
Description
CVE-2026-78061 is a server-side request forgery (SSRF) vulnerability in vas3k TaxHacker versions 0.8.0, 0.8.1, and 0.8.2. The flaw exists in the buildImapConfig function within the Email Sync component, where manipulation of the host or port arguments can lead to SSRF. This vulnerability can be exploited remotely. A patch has been developed but is pending acceptance. The product is a cloud service, so remediation may be managed by the vendor.
CVSS v4.0
Score 5.3medium
Affected software
pkg:github/vas3k/TaxHackercpe:2.3:a:vas3k:taxhacker:*:*:*:*:*:*:*:*Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability affects the buildImapConfig function in the lib/email-sync/imap-client.ts file of vas3k TaxHacker up to version 0.8.2. By manipulating the host or port parameters, an attacker can trigger server-side request forgery, potentially causing the server to make unintended requests. The vulnerability is remotely exploitable. A fix has been created but is awaiting acceptance. The product is cloud-hosted, which typically means the vendor manages patch deployment.
Potential Impact
Successful exploitation allows an attacker to induce the server to make arbitrary requests, which may lead to information disclosure or interaction with internal systems not otherwise accessible. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low complexity, no user interaction, and limited impact on confidentiality, integrity, and availability.
Mitigation Recommendations
A patch is available but currently pending acceptance. Since TaxHacker is a cloud service, the vendor likely manages remediation server-side. Users should monitor vendor advisories for patch deployment status and apply updates once the fix is accepted and released. No other vendor-provided mitigations are currently documented.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-08-22T10:54:25.793Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
- Is Cloud Service
- true
Threat ID: 6a8a6e87acd9273b496a8ac3
Added to database: 08/23/2026, 03:52:39 UTC
Last enriched: 08/23/2026, 04:07:03 UTC
Last updated: 08/23/2026, 04:11:59 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.