Server-Side Request Forgery Vulnerability in vas3k TaxHacker Email Sync Component
CVE-2026-78061

5.3MEDIUM

Key Information:

Vendor

Vas3k

Status
Taxhacker
Vendor
CVE Published:
23 August 2026

What is CVE-2026-78061?

A vulnerability is present in the vas3k TaxHacker application, specifically within the Email Sync component. The issue pertains to the buildImapConfig function located in the imap-client.ts file. An attacker can exploit this vulnerability by manipulating the host and port parameters, leading to a potential server-side request forgery. This attack can be conducted remotely, potentially allowing unauthorized interaction with internal services that should not be exposed. A patch for this vulnerability is currently in the review process.

Affected Version(s)

TaxHacker 0.8.0

TaxHacker 0.8.1

TaxHacker 0.8.2

References

https://vuldb.com/vuln/394301
vdb-entrytechnical-description
https://vuldb.com/vuln/394301/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-78061
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

keyblue (VulDB User)
VulDB CNA Team
.