CVE-2026-78061: vas3k TaxHacker Email Sync imap-client.ts buildImapConfig server-side request forgery
A vulnerability was determined in vas3k TaxHacker up to 0.8.2. Impacted is the function buildImapConfig of the file lib/email-sync/imap-client.ts of the component Email Sync. Executing a manipulation of the argument host/port can lead to server-side request forgery. It is possible to launch the attack remotely. The pull request to fix this issue awaits acceptance.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
The attack can be launched remotely, but the severity vector indicates that low privileges are required. An attacker would need a way to supply or manipulate the Email Sync host or port values.
Which deployments are affected?
TaxHacker versions up to 0.8.2 are identified as affected. The issue is in the Email Sync component's IMAP configuration handling; the provided data does not establish whether Email Sync is enabled by default.
What can be done before a fix is available?
Restrict who can configure or modify Email Sync host and port settings, and limit the application's outbound network access so it cannot reach internal or otherwise sensitive services. The referenced fix pull request is still awaiting acceptance.
How can administrators assess exposure?
Review whether the affected TaxHacker deployment uses Email Sync and whether low-privileged users can influence its IMAP host or port configuration. Systems running versions up to 0.8.2 with such access should be treated as potentially exposed.