CVE-2026-78061

EUVD-2026-64626
A vulnerability was determined in vas3k TaxHacker up to 0.8.2. Impacted is the function buildImapConfig of the file lib/email-sync/imap-client.ts of the component Email Sync. Executing a manipulation of the argument host/port can lead to server-side request forgery. It is possible to launch the attack remotely. The pull request to fix this issue awaits acceptance.
SSRF
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 29.83%
Common Weakness Enumeration
References
https://github.com/vas3k/TaxHacker/
https://github.com/vas3k/TaxHacker/issues/148
https://github.com/vas3k/TaxHacker/pull/170
https://vuldb.com/cve/CVE-2026-78061
https://vuldb.com/submit/881825
https://vuldb.com/vuln/394301
https://vuldb.com/vuln/394301/cti