{"id":8891,"date":"2026-11-13T17:21:21","date_gmt":"2026-11-13T17:21:21","guid":{"rendered":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-125749-taxhacker-idor-settings-actions"},"modified":"2026-11-13T17:21:21","modified_gmt":"2026-11-13T17:21:21","slug":"cve-2026-125749-taxhacker-idor-settings-actions","status":"publish","type":"post","link":"https:\/\/i10x.ai\/news\/cve-2026-125749-taxhacker-idor-settings-actions","title":{"rendered":"CVE-2026-125749: TaxHacker through 0.8.5 IDOR lets users delete other users&#8217; categories"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">\u26a1 Quick Take<\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>What:<\/strong> CVE-2026-125749, an insecure direct object reference (IDOR) vulnerability in TaxHacker through version 0.8.5, allows authenticated users to modify or delete other users&#8217; categories, projects, custom fields, and currencies.<\/li><li><strong>Who is affected:<\/strong> Multi-user TaxHacker deployments (SELF_HOSTED_MODE=false). Single-user self-hosted instances are not affected.<\/li><li><strong>What to do:<\/strong> Update to a version containing commit d84a912 or later. The fix was merged on November 10, 2026.<\/li><li><strong>Severity:<\/strong> Medium (CVSS 4.2). Requires authentication and knowledge of the victim&#8217;s UUID.<\/li><li><strong>Status:<\/strong> Patch available as of November 10, 2026.<\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">In plain English<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">TaxHacker is a self-hosted accounting app that uses AI to categorize expenses. A security flaw in versions up to 0.8.5 let one logged-in user mess with another user&#8217;s accounting setup. If an attacker knew your user ID (a long random code), they could delete your expense categories, change your project settings, or wipe out how your transactions were organized. This only affects installations that allow multiple users to sign up. If you run a multi-user instance, update to the latest version from GitHub.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What happened<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Security researcher hieuPenguinnn discovered that twelve Server Actions in TaxHacker&#8217;s settings module accepted a userId parameter directly from the client without verifying it matched the authenticated session. The vulnerable functions are in app\/(app)\/settings\/actions.ts and include addProjectAction, editProjectAction, deleteProjectAction, addCurrencyAction, editCurrencyAction, deleteCurrencyAction, addCategoryAction, editCategoryAction, deleteCategoryAction, addFieldAction, editFieldAction, and deleteFieldAction.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Every other Server Action in the TaxHacker codebase calls getCurrentUser() to resolve the acting user from the session and then uses user.id. The settings CRUD actions instead took userId as their first argument and passed it straight to the model layer. Because Next.js Server Actions exported from a &#8220;use server module are directly invocable RPC endpoints, an authenticated attacker could call, for example, deleteCategoryAction(victim-user-id&#8221;, &#8220;office&#8221;) to delete another user&#8217;s category and null the categoryCode on that user&#8217;s transactions.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The middleware in proxy.ts only checks that a session cookie is present on a fixed list of path prefixes. It does not verify that the userId in the action call matches the authenticated user. The model functions in models\/categories.ts, models\/projects.ts, models\/fields.ts, and models\/currencies.ts correctly scope their queries to the userId they receive, but they trust the value passed in.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The vulnerability was reported on November 5, 2026, in GitHub issue #204. The maintainer vas3k closed the issue on November 10, 2026, with a fix in commit d84a912f3a06b141cc275bb07115a204e7f10128. The fix removes the userId parameter from all twelve actions and instead calls getCurrentUser() inside each function, matching the pattern used everywhere else in the codebase.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What you should do<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">If you run a multi-user TaxHacker instance (SELF_HOSTED_MODE=false), update to a version that includes commit d84a912 or later. The project does not use semantic versioning for every commit, so pull the latest code from the main branch on GitHub. If you run TaxHacker in single-user mode (the default for self-hosted deployments), you are not affected and no action is required.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What it means<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">This vulnerability is a textbook example of CWE-639 (Authorization Bypass Through User-Controlled Key) and CWE-862 (Missing Authorization). The impact is limited to integrity and availability of another user&#8217;s accounting configuration and transaction classification. An attacker cannot read another user&#8217;s documents or transaction details through this flaw, only corrupt or delete their categories, projects, custom fields, and currencies. The attacker must be authenticated and must know the victim&#8217;s userId, which is a random UUID not enumerable from these endpoints. The CVSS score of 4.2 reflects the need for authentication and prior knowledge of the victim&#8217;s identifier.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Sources<\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-125749\" target=\"_blank\" rel=\"noreferrer noopener\">NVD CVE-2026-125749<\/a><\/li><li><a href=\"https:\/\/github.com\/vas3k\/TaxHacker\/blob\/v0.8.5\/app\/(app)\/settings\/actions.ts#L117-L306\" target=\"_blank\" rel=\"noreferrer noopener\">TaxHacker vulnerable code (v0.8.5)<\/a><\/li><li><a href=\"https:\/\/github.com\/vas3k\/TaxHacker\/commit\/d84a912f3a06b141cc275bb07115a204e7f10128\" target=\"_blank\" rel=\"noreferrer noopener\">Fix commit d84a912<\/a><\/li><li><a href=\"https:\/\/github.com\/vas3k\/TaxHacker\/issues\/204\" target=\"_blank\" rel=\"noreferrer noopener\">GitHub issue #204<\/a><\/li><li><a href=\"https:\/\/hackmd.io\/@hieund\/taxhacker-settings-crud-actions-cross-user-authz\" target=\"_blank\" rel=\"noreferrer noopener\">Full analysis by hieuPenguinnn<\/a><\/li><li><a href=\"https:\/\/www.vulncheck.com\/advisories\/taxhacker-through-0.8.5-idor-via-settings-server-actions-userid\" target=\"_blank\" rel=\"noreferrer noopener\">VulnCheck advisory<\/a><\/li><\/ul>\n","protected":false},"excerpt":{"rendered":"<p>TaxHacker through 0.8.5 contains an insecure direct object reference vulnerability in settings Server Actions that allows authenticated users to modify other users&#8217; data by supplying an arbitrary userId.<\/p>\n","protected":false},"author":2,"featured_media":8890,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"paper_title":"","paper_url":"","pdf_url":"","doi":"","arxiv_id":"","authors":"","institutions":"","paper_date":"","venue":"","peer_reviewed":false,"code_url":"","data_url":"","funding_coi":"","figure_license":"","paper_license":"","replication":"","study_models":"","study_sample":"","footnotes":"","_yoast_wpseo_primary_category":"65","_nx_sec_severity":"medium","_nx_sec_affected":"TaxHacker through 0.8.5 in multi-user mode (SELF_HOSTED_MODE=false)","_nx_sec_status":"patch-available","_nx_sec_kicker":"ALERT: TaxHacker IDOR let users trash each other's accounting data","_nx_sec_type":"coding","_nx_sec_vendor":"TaxHacker","_nx_sec_fixed":"","_nx_sec_action":"Update to a version containing commit d84a912 or later from the main branch"},"categories":[65,22,12,28],"tags":[],"companies":[],"products":[],"class_list":["post-8891","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ai-security","category-coding","category-policy-safety","category-security-defense"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.7 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>CVE-2026-125749: TaxHacker IDOR in settings actions<\/title>\n<meta name=\"description\" content=\"CVE-2026-125749 in TaxHacker through 0.8.5 lets authenticated users delete or modify other users&#039; categories, projects, and fields via Server Actions.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/i10xnews.kinsta.cloud\/cve-2026-125749-taxhacker-idor-settings-actions\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"CVE-2026-125749: TaxHacker IDOR in settings actions\" \/>\n<meta property=\"og:description\" content=\"CVE-2026-125749 in TaxHacker through 0.8.5 lets authenticated users delete or modify other users&#039; categories, projects, and fields via Server Actions.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/i10xnews.kinsta.cloud\/cve-2026-125749-taxhacker-idor-settings-actions\" \/>\n<meta property=\"og:site_name\" content=\"i10X News\" \/>\n<meta property=\"article:published_time\" content=\"2026-11-13T17:21:21+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/11\/cve-2026-125749-taxhacker-idor-settings-actions-title.webp\" \/>\n\t<meta property=\"og:image:width\" content=\"1344\" \/>\n\t<meta property=\"og:image:height\" content=\"768\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/webp\" \/>\n<meta name=\"author\" content=\"Christopher Ort\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/i10x-news-og-default-1200x630-1.png\" \/>\n<meta name=\"twitter:creator\" content=\"@i10x_ai\" \/>\n<meta name=\"twitter:site\" content=\"@i10x_ai\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Christopher Ort\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"NewsArticle\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-125749-taxhacker-idor-settings-actions#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-125749-taxhacker-idor-settings-actions\"},\"author\":{\"name\":\"Christopher Ort\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/person\\\/d410bb7ee72febefca2c9c369939219a\"},\"headline\":\"CVE-2026-125749: TaxHacker through 0.8.5 IDOR lets users delete other users&#8217; categories\",\"datePublished\":\"2026-11-13T17:21:21+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-125749-taxhacker-idor-settings-actions\"},\"wordCount\":635,\"publisher\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-125749-taxhacker-idor-settings-actions#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/cve-2026-125749-taxhacker-idor-settings-actions-title.webp\",\"articleSection\":[\"AI Security\",\"Coding\",\"Policy &amp; Safety\",\"Security &amp; Defense\"],\"inLanguage\":\"en-US\",\"dateModified\":\"2026-11-13T17:21:21+00:00\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-125749-taxhacker-idor-settings-actions\",\"url\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-125749-taxhacker-idor-settings-actions\",\"name\":\"CVE-2026-125749: TaxHacker IDOR in settings actions\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-125749-taxhacker-idor-settings-actions#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-125749-taxhacker-idor-settings-actions#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/cve-2026-125749-taxhacker-idor-settings-actions-title.webp\",\"datePublished\":\"2026-11-13T17:21:21+00:00\",\"description\":\"CVE-2026-125749 in TaxHacker through 0.8.5 lets authenticated users delete or modify other users' categories, projects, and fields via Server Actions.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-125749-taxhacker-idor-settings-actions#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-125749-taxhacker-idor-settings-actions\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-125749-taxhacker-idor-settings-actions#primaryimage\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/cve-2026-125749-taxhacker-idor-settings-actions-title.webp\",\"contentUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/cve-2026-125749-taxhacker-idor-settings-actions-title.webp\",\"width\":1344,\"height\":768,\"caption\":\"Image: AI-generated, i10X\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-125749-taxhacker-idor-settings-actions#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/i10x.ai\\\/news\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"CVE-2026-125749: TaxHacker through 0.8.5 IDOR lets users delete other users&#8217; categories\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#website\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\",\"name\":\"i10X News\",\"description\":\"Stay updated with the latest news and announcements from i10X.\",\"publisher\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/i10x.ai\\\/news?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\",\"name\":\"i10X\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/i10x-logo-180.png\",\"contentUrl\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/i10x-logo-180.png\",\"width\":180,\"height\":180,\"caption\":\"i10X\"},\"image\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/i10x_ai\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/i10x-ai\",\"https:\\\/\\\/instagram.com\\\/i10x.ai\",\"https:\\\/\\\/www.youtube.com\\\/@i10X_ai_official\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/person\\\/d410bb7ee72febefca2c9c369939219a\",\"name\":\"Christopher Ort\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/christopher-ort-192.webp\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/christopher-ort-192.webp\",\"contentUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/christopher-ort-192.webp\",\"caption\":\"Christopher Ort\"},\"description\":\"Christopher Ort handles SEO, AI agent workflows and PR & partnerships at i10x.ai, the all-in-one AI workspace built by i10X Global Pte. Ltd. in Singapore. He is a graduate of Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU). He is the author of \u201cThe Style Penalty\u201d, a study published on SSRN that analyses 1,576 evaluation decisions by four frontier AI models to show how AI-written CVs fare in automated hiring screens; the research has been covered by heise online and t3n.\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/author\\\/christopher-ort\",\"sameAs\":[\"https:\\\/\\\/i10x.ai\\\/blog\\\/author\\\/christopher-ort\"],\"worksFor\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\"},\"alumniOf\":{\"@type\":\"EducationalOrganization\",\"name\":\"Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU)\",\"url\":\"https:\\\/\\\/www.fau.eu\"},\"subjectOf\":[{\"@type\":\"CreativeWork\",\"url\":\"https:\\\/\\\/papers.ssrn.com\\\/abstract=7426699\",\"name\":\"The Style Penalty: How AI Resume-Writing Tools Shape Outcomes in Automated Hiring Screens\"},{\"@type\":\"CreativeWork\",\"url\":\"https:\\\/\\\/www.heise.de\\\/news\\\/KI-Chatbots-bewerten-KI-Lebenslaeufe-Claude-findet-sich-besser-als-GPT-11317531.html\",\"name\":\"KI-Chatbots bewerten KI-Lebensl\u00e4ufe: Claude findet sich besser als GPT\"},{\"@type\":\"CreativeWork\",\"url\":\"https:\\\/\\\/t3n.de\\\/news\\\/bewerbung-schreiben-ki-5-fehler-1747190\\\/\",\"name\":\"Bewerbung mit KI schreiben: Diese 5 Fehler solltet ihr laut Studien vermeiden\"}]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"CVE-2026-125749: TaxHacker IDOR in settings actions","description":"CVE-2026-125749 in TaxHacker through 0.8.5 lets authenticated users delete or modify other users' categories, projects, and fields via Server Actions.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-125749-taxhacker-idor-settings-actions","og_locale":"en_US","og_type":"article","og_title":"CVE-2026-125749: TaxHacker IDOR in settings actions","og_description":"CVE-2026-125749 in TaxHacker through 0.8.5 lets authenticated users delete or modify other users' categories, projects, and fields via Server Actions.","og_url":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-125749-taxhacker-idor-settings-actions","og_site_name":"i10X News","article_published_time":"2026-11-13T17:21:21+00:00","og_image":[{"width":1344,"height":768,"url":"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/11\/cve-2026-125749-taxhacker-idor-settings-actions-title.webp","type":"image\/webp"}],"author":"Christopher Ort","twitter_card":"summary_large_image","twitter_image":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/i10x-news-og-default-1200x630-1.png","twitter_creator":"@i10x_ai","twitter_site":"@i10x_ai","twitter_misc":{"Written by":"Christopher Ort","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"NewsArticle","@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-125749-taxhacker-idor-settings-actions#article","isPartOf":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-125749-taxhacker-idor-settings-actions"},"author":{"name":"Christopher Ort","@id":"https:\/\/i10x.ai\/news\/#\/schema\/person\/d410bb7ee72febefca2c9c369939219a"},"headline":"CVE-2026-125749: TaxHacker through 0.8.5 IDOR lets users delete other users&#8217; categories","datePublished":"2026-11-13T17:21:21+00:00","mainEntityOfPage":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-125749-taxhacker-idor-settings-actions"},"wordCount":635,"publisher":{"@id":"https:\/\/i10x.ai\/news\/#organization"},"image":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-125749-taxhacker-idor-settings-actions#primaryimage"},"thumbnailUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/cve-2026-125749-taxhacker-idor-settings-actions-title.webp","articleSection":["AI Security","Coding","Policy &amp; Safety","Security &amp; Defense"],"inLanguage":"en-US","dateModified":"2026-11-13T17:21:21+00:00"},{"@type":"WebPage","@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-125749-taxhacker-idor-settings-actions","url":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-125749-taxhacker-idor-settings-actions","name":"CVE-2026-125749: TaxHacker IDOR in settings actions","isPartOf":{"@id":"https:\/\/i10x.ai\/news\/#website"},"primaryImageOfPage":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-125749-taxhacker-idor-settings-actions#primaryimage"},"image":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-125749-taxhacker-idor-settings-actions#primaryimage"},"thumbnailUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/cve-2026-125749-taxhacker-idor-settings-actions-title.webp","datePublished":"2026-11-13T17:21:21+00:00","description":"CVE-2026-125749 in TaxHacker through 0.8.5 lets authenticated users delete or modify other users' categories, projects, and fields via Server Actions.","breadcrumb":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-125749-taxhacker-idor-settings-actions#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/i10xnews.kinsta.cloud\/cve-2026-125749-taxhacker-idor-settings-actions"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-125749-taxhacker-idor-settings-actions#primaryimage","url":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/cve-2026-125749-taxhacker-idor-settings-actions-title.webp","contentUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/cve-2026-125749-taxhacker-idor-settings-actions-title.webp","width":1344,"height":768,"caption":"Image: AI-generated, i10X"},{"@type":"BreadcrumbList","@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-125749-taxhacker-idor-settings-actions#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/i10x.ai\/news"},{"@type":"ListItem","position":2,"name":"CVE-2026-125749: TaxHacker through 0.8.5 IDOR lets users delete other users&#8217; categories"}]},{"@type":"WebSite","@id":"https:\/\/i10x.ai\/news\/#website","url":"https:\/\/i10x.ai\/news","name":"i10X News","description":"Stay updated with the latest news and announcements from i10X.","publisher":{"@id":"https:\/\/i10x.ai\/news\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/i10x.ai\/news?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/i10x.ai\/news\/#organization","name":"i10X","url":"https:\/\/i10x.ai\/news\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i10x.ai\/news\/#\/schema\/logo\/image\/","url":"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/10\/i10x-logo-180.png","contentUrl":"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/10\/i10x-logo-180.png","width":180,"height":180,"caption":"i10X"},"image":{"@id":"https:\/\/i10x.ai\/news\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/i10x_ai","https:\/\/www.linkedin.com\/company\/i10x-ai","https:\/\/instagram.com\/i10x.ai","https:\/\/www.youtube.com\/@i10X_ai_official"]},{"@type":"Person","@id":"https:\/\/i10x.ai\/news\/#\/schema\/person\/d410bb7ee72febefca2c9c369939219a","name":"Christopher Ort","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/christopher-ort-192.webp","url":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/christopher-ort-192.webp","contentUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/christopher-ort-192.webp","caption":"Christopher Ort"},"description":"Christopher Ort handles SEO, AI agent workflows and PR & partnerships at i10x.ai, the all-in-one AI workspace built by i10X Global Pte. Ltd. in Singapore. He is a graduate of Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU). He is the author of \u201cThe Style Penalty\u201d, a study published on SSRN that analyses 1,576 evaluation decisions by four frontier AI models to show how AI-written CVs fare in automated hiring screens; the research has been covered by heise online and t3n.","url":"https:\/\/i10x.ai\/news\/author\/christopher-ort","sameAs":["https:\/\/i10x.ai\/blog\/author\/christopher-ort"],"worksFor":{"@id":"https:\/\/i10x.ai\/news\/#organization"},"alumniOf":{"@type":"EducationalOrganization","name":"Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU)","url":"https:\/\/www.fau.eu"},"subjectOf":[{"@type":"CreativeWork","url":"https:\/\/papers.ssrn.com\/abstract=7426699","name":"The Style Penalty: How AI Resume-Writing Tools Shape Outcomes in Automated Hiring Screens"},{"@type":"CreativeWork","url":"https:\/\/www.heise.de\/news\/KI-Chatbots-bewerten-KI-Lebenslaeufe-Claude-findet-sich-besser-als-GPT-11317531.html","name":"KI-Chatbots bewerten KI-Lebensl\u00e4ufe: Claude findet sich besser als GPT"},{"@type":"CreativeWork","url":"https:\/\/t3n.de\/news\/bewerbung-schreiben-ki-5-fehler-1747190\/","name":"Bewerbung mit KI schreiben: Diese 5 Fehler solltet ihr laut Studien vermeiden"}]}]}},"_links":{"self":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts\/8891","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/comments?post=8891"}],"version-history":[{"count":0,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts\/8891\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/media\/8890"}],"wp:attachment":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/media?parent=8891"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/categories?post=8891"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/tags?post=8891"},{"taxonomy":"company","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/companies?post=8891"},{"taxonomy":"product","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/products?post=8891"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}