{"id":"CVE-2026-125749","kind":"vulnerability","aliases":["CVE-2026-125749"],"related":[],"title":"TaxHacker: authenticated users can modify other users' settings and data","description":"TaxHacker through 0.8.5 contains an insecure direct object reference vulnerability in app/(app)/settings/actions.ts that allows authenticated users to modify other users' data by supplying an arbitrary userId. Attackers can invoke Server Actions like deleteCategoryAction or editFieldAction with a victim's UUID to delete categories, clear transaction assignments, or alter LLM prompts.","summary":"TaxHacker through 0.8.5 trusts a user ID supplied in a request, so a logged-in user can act on another user's records. An attacker can delete categories, clear transaction assignments, or alter LLM prompts belonging to a victim.","severity":"medium","cvss":4.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"TaxHacker","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["nextjs","other","self-hosted","taxhacker"],"not_affected_if":["no-open-signup","single-user"],"how_to_check":"- Check the installed TaxHacker version; versions through `0.8.5` are affected.\n- Review `app/(app)/settings/actions.ts` for server actions that take a `userId` from the request instead of the session.","fix":"- Move to a version later than `0.8.5`; the sources do not name the exact fixed version.","status":"open","published_at":"2026-11-10T16:17:20+00:00","first_seen_at":"2026-11-10T16:22:34+00:00","triaged_at":"2026-11-10T16:23:44+00:00","updated_at":"2026-11-10T16:23:44+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-10T16:23:44Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a version later than `0.8.5`; the sources do not name the exact fixed version.","reach":"network","title":"TaxHacker: authenticated users can modify other users' settings and data","impact":"medium","summary":"TaxHacker through 0.8.5 trusts a user ID supplied in a request, so a logged-in user can act on another user's records. An attacker can delete categories, clear transaction assignments, or alter LLM prompts belonging to a victim.","audience":"businesses","category":"other","nicknames":[],"who_cares":["taxhacker","self-hosted","nextjs"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker deletes or alters other users' categories, transactions and prompts","analyst_note":"Confirm the fixed version from the linked GitHub patch and the VulnCheck advisory; sources do not name it.","how_to_check":"- Check the installed TaxHacker version; versions through `0.8.5` are affected.\n- Review `app/(app)/settings/actions.ts` for server actions that take a `userId` from the request instead of the session.","plain_action":"","product_name":"TaxHacker","needs_analyst":true,"not_affected_if":["single-user","no-open-signup"],"who_is_affected":"Teams that self-host TaxHacker with multiple user accounts are exposed, since any authenticated user can target another user's UUID. Single-user installs have little other-user data to reach, and instances without open sign-up limit who can authenticate.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000748,"input_tokens":4632,"output_tokens":569,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125749':13A,16A '-2026':12A,15A '/settings/actions.ts':77C '0.8.5':26B,66C 'act':42B 'action':96C 'allow':79C 'alter':57B,113C 'anoth':44B 'app':75C,76C 'arbitrari':90C 'assign':55B,111C 'attack':49B,92C 'authent':2A,80C 'belong':60B 'categori':52B,108C 'clear':53B,109C 'contain':67C 'cve':11A,14A 'data':10A,86C 'delet':51B,107C 'deletecategoryact':98C 'direct':70C 'editfieldact':100C 'host':22B 'id':30B 'insecur':69C 'invok':94C 'like':97C 'llm':58B,114C 'log':38B 'logged-in':37B 'modifi':5A,83C 'nextj':18B 'object':71C 'prompt':59B,115C 'record':47B 'refer':72C 'request':34B 'self':21B 'self-host':20B 'server':95C 'set':8A 'suppli':31B,88C 'taxhack':1A,23B,24B,64C 'taxhacker':17A 'transact':54B,110C 'trust':27B 'user':3A,7A,29B,40B,45B,81C,85C 'userid':91C 'uuid':105C 'victim':63B,103C 'vulner':73C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host TaxHacker with multiple user accounts are exposed, since any authenticated user can target another user's UUID. Single-user installs have little other-user data to reach, and instances without open sign-up limit who can authenticate.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["taxhacker"],"ptokens":["taxhacker"],"labels":["medium","nextjs","other","selfhosted","taxhacker","vendor"],"campaign_type":null,"search_a":"'-125749':13A,16A '-2026':12A,15A 'authent':2A 'cve':11A,14A 'data':10A 'modifi':5A 'set':8A 'taxhack':1A 'taxhacker':17A 'user':3A,7A","search_b":"'0.8.5':26B 'act':42B 'alter':57B 'anoth':44B 'assign':55B 'attack':49B 'belong':60B 'categori':52B 'clear':53B 'delet':51B 'host':22B 'id':30B 'llm':58B 'log':38B 'logged-in':37B 'nextj':18B 'prompt':59B 'record':47B 'request':34B 'self':21B 'self-host':20B 'suppli':31B 'taxhack':23B,24B 'transact':54B 'trust':27B 'user':29B,40B,45B 'victim':63B","search_c":"'/settings/actions.ts':77C '0.8.5':66C 'action':96C 'allow':79C 'alter':113C 'app':75C,76C 'arbitrari':90C 'assign':111C 'attack':92C 'authent':80C 'categori':108C 'clear':109C 'contain':67C 'data':86C 'delet':107C 'deletecategoryact':98C 'direct':70C 'editfieldact':100C 'insecur':69C 'invok':94C 'like':97C 'llm':114C 'modifi':83C 'object':71C 'prompt':115C 'refer':72C 'server':95C 'suppli':88C 'taxhack':64C 'transact':110C 'user':81C,85C 'userid':91C 'uuid':105C 'victim':103C 'vulner':73C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T16:17:20+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125749","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125749","severity":null,"published_at":"2026-11-10T16:17:20+00:00","modified_at":"2026-11-10T16:17:20+00:00","first_seen_at":"2026-11-10T16:22:34+00:00","fetched_at":"2026-11-10T16:22:34+00:00","note":null}],"documents":[{"id":116112,"url":"https://github.com/vas3k/TaxHacker/commit/d84a912f3a06b141cc275bb07115a204e7f10128","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":116113,"url":"https://www.vulncheck.com/advisories/taxhacker-through-0.8.5-idor-via-settings-server-actions-userid","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}