CVE-2026-125749

TaxHacker settings changes could affect another user’s accounting prompts

TaxHacker project / VulnCheck · TaxHacker accounting settings and LLM prompts

First documented disclosure · Review checkpoint

Summary

An authenticated user could change another account’s settings, including prompt fields used for automated accounting.

Severity and exploitation evidence

Low · 2.3/10 · CVSS 4.0. Severity source.

Exploitation not established: The reviewed sources describe the vulnerability and its conditions. They do not identify malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Settings actions trusted a user identifier sent by the client instead of deriving the acting user from the authenticated session.

Conditions required

An authenticated caller can identify another account and reach the affected settings operations.

Potential impact

Other users’ custom extraction prompts, categories or transaction assignments could be changed. The CNA rates the effect on integrity and availability low.

Affected versions and configurations

Through 0.8.5.

Fix and mitigation status

Upstream commit d84a912 fixes the settings actions. The latest reviewed release tag was 0.8.5 and predates the fix.

Practical next steps

Deploy a verified build containing upstream commit d84a912 and review changes to custom prompts and accounting settings.

Operating lesson

Derive the owner of settings changes from the signed-in identity.

Evidence and limits

The CNA identifies effects on LLM prompts. The November 10 source fix uses the authenticated user for settings updates. No later tagged release was identified at review.

Sources