CVE-2026-125749

TaxHacker through 0.8.5 contains an insecure direct object reference vulnerability in app/app/settings/actions.ts that allows authenticated users to modify other users' data by supplying an arbitrary userId. Attackers can invoke Server Actions like deleteCategoryAction or editFieldAction with a...