CVE-2026-125749
4.2 MEDIUMpublic exploit availablePublished 2026-11-10 · Updated 2026-11-10
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
TaxHacker through 0.8.5 contains an insecure direct object reference vulnerability in app/(app)/settings/actions.ts that allows authenticated users to modify other users' data by supplying an arbitrary userId. Attackers can invoke Server Actions like deleteCategoryAction or editFieldAction with a victim's UUID to delete categories, clear transaction assignments, or alter LLM prompts.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L
Weaknesses
CWE-639
Public exploit & PoC references
All references
- https://github.com/vas3k/TaxHacker/blob/v0.8.5/app/(app)/settings/actions.ts#L117-L306
- https://github.com/vas3k/TaxHacker/commit/d84a912f3a06b141cc275bb07115a204e7f10128
- https://github.com/vas3k/TaxHacker/issues/204
- https://hackmd.io/@hieund/taxhacker-settings-crud-actions-cross-user-authz
- https://www.vulncheck.com/advisories/taxhacker-through-0.8.5-idor-via-settings-server-actions-userid
- https://hackmd.io/@hieund/cve-2026-125749-taxhacker-settings-crud-actions-cross-user-authz
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- CRITICALCVE-2024-34323
- MEDIUMCVE-2025-71420PoC
- MEDIUMCVE-2026-100142
- UNSCOREDCVE-2026-100177PoC
- HIGHCVE-2026-100268
- MEDIUMCVE-2026-100272
- HIGHCVE-2026-100364PoC
- HIGHCVE-2026-100514
Related by shared AI tags and CWE weakness class. Browse the full archive.