Threats affecting pkg:github/TaxHacker

CVE-2026-125749 is an authorization bypass vulnerability in vas3k TaxHacker versions up to 0.8.5. It allows authenticated users to manipulate other users' data by providing arbitrary user IDs to server actions. This can lead to unauthorized deletion of categories, clearing of transaction assignments, or modification of LLM prompts. The vulnerability has a low CVSS score of 2.3 and affects cloud-hosted services.