CVE-2026-125749

MediumCVSS 4.2/10Last modified Nov 12, 2026

Description

TaxHacker through 0.8.5 contains an insecure direct object reference vulnerability in app/(app)/settings/actions.ts that allows authenticated users to modify other users' data by supplying an arbitrary userId. Attackers can invoke Server Actions like deleteCategoryAction or editFieldAction with a victim's UUID to delete categories, clear transaction assignments, or alter LLM prompts.

Metrics

CVSS 3.1 4.2/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published: Nov 10, 2026
Last modified: Nov 12, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-125757.5DVP80ES3 with Improper Resource Shutdown or Release vulnerability.CVE-2026-1257507.1Firekylin through 2.18.1 contains an improper authorization vulnerability that allows editor-role users to read administrator-only secrets b CVE-2026-1257513.1Meteroid before 2.2.0 contains an authorization bypass vulnerability in the ApiTokensService GetApiTokenById gRPC handler that fails to appl CVE-2026-1257525.0Meteroid before 2.2.0 contains a cross-tenant authorization bypass vulnerability in the CouponsService UpdateCouponStatus gRPC handler, whos CVE-2026-1257535.9ABP Framework 2.9.0 before 10.6.2 and 10.7.0 pre-releases before 10.7.0 contain a path traversal vulnerability in DefaultBlobFilePathCalcula CVE-2026-1257547.1Dolibarr 20.0.0 through 23.0.4 and 24.x before 24.0.2 contains an insecure direct object reference vulnerability in api_expensereports.class CVE-2026-1257556.5Nodemailer 3.0.0 before 10.4.1 contains an address parsing flaw in addressparser that truncates domains at folding whitespace or comments be CVE-2026-1257565.9postal-mime before 4.2.1 contains a parser differential vulnerability in its address parser that truncates the domain at folding whitespace CVE-2026-1257579.1mailcow: dockerized before 2026-11 contains a server-side template injection vulnerability that allows domain administrators to execute comm CVE-2026-1257587.4Aptabase before commit 61d4c01 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge sign-in links CVE-2026-1257597.5Nango before 0.71.3 contains an sql injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL by supplying a cr CVE-2026-125767.5DVP80ES3 with Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability.