CVE-2026-125749

TaxHacker through 0.8.5 contains an insecure direct object reference vulnerability in app/app/settings/actions.ts that allows authenticated users to modify other users' data by supplying an arbitrary userId. Attackers can invoke Server Actions like deleteCategoryAction or editFieldAction with a...

CVE-2026-125749 TaxHacker through 0.8.5 IDOR via Settings Server Actions userId

TaxHacker through 0.8.5 contains an insecure direct object reference vulnerability in app/app/settings/actions.ts that allows authenticated users to modify other users' data by supplying an arbitrary userId. Attackers can invoke Server Actions like deleteCategoryAction or editFieldAction with a...

CVE-2026-125749

The software TaxHacker (versions through 0.8.5) is vulnerable to an Insecure Direct Object Reference (IDOR) in the app/(app)/settings/actions.ts component. This flaw allows authenticated users to modify the data of other users by providing an arbitrary userId . Specifically, an attacker can lever...

EUVD-2026-121231

TaxHacker through 0.8.5 contains an insecure direct object reference vulnerability in app/app/settings/actions.ts that allows authenticated users to modify other users' data by supplying an arbitrary userId. Attackers can invoke Server Actions like deleteCategoryAction or editFieldAction with a...

PT-2026-141745

TaxHacker through 0.8.5 contains an insecure direct object reference vulnerability in app/app/settings/actions.ts that allows authenticated users to modify other users' data by supplying an arbitrary userId. Attackers can invoke Server Actions like deleteCategoryAction or editFieldAction with a...

CVE-2026-125749: vas3k TaxHacker: TaxHacker through 0.8.5 contains an insecure direct object reference vulnerability in app/(app)/settings/actions.ts…

TaxHacker through 0.8.5 contains an insecure direct object reference vulnerability in app/app/settings/actions.ts that allows authenticated users to modify other users' data by supplying an arbitrary userId. Attackers can invoke Server Actions like deleteCategoryAction or editFieldAction with a...