CVE-2026-78061 — vas3k TaxHacker Email Sync imap-client.ts buildImapConfig server-side request forgery
A vulnerability was determined in vas3k TaxHacker up to 0.8.2. Impacted is the function buildImapConfig of the file lib/email-sync/imap-client.ts of the component Email Sync. Ex…
Published: 2026-08-23 · CVSS: 5.3 · CVSS 4.0
A vulnerability was determined in vas3k TaxHacker up to 0.8.2. Impacted is the function buildImapConfig of the file lib/email-sync/imap-client.ts of the component Email Sync. Executing a manipulation of the argument host/port can lead to server-side request forgery. It is possible to launch the attack remotely. The pull request to fix this issue awaits acceptance.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7