CVE-2026-79759: Termix: Cross-User Information Disclosure via Missing Ownership Check in deploy-to-host Endpoint
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, the POST /credentials/:id/deploy-to-host endpoint resolves credential and target-host records from attacker-controlled credentialId and targetHostId integer values without checking that either record belongs to the requesting user. In src/backend/database/routes/credentials.ts, differential errors reveal whether credential and host records exist and disclose each record's authType value. Properly encrypted passwords and keys are not disclosed, but a key-authenticated victim host can receive an outbound SSH connection attempt using the attacker's public key. This issue is fixed in version 2.5.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Termixto a version that resolves this vulnerability.Fixed in 2.5.1
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Termix user with low privileges can exploit the endpoint remotely. The attacker must be able to submit chosen integer credentialId and targetHostId values to the deploy-to-host endpoint.
What information or impact is exposed?
Differential error responses can reveal whether credential and host records exist and disclose their authType values. Encrypted passwords and private keys are not disclosed; however, a victim host configured for key authentication may receive an outbound SSH connection attempt using the attacker’s public key.
Are all affected versions vulnerable by default?
The vulnerable behavior is present from version 1.7.0 until 2.5.1 because the endpoint does not verify that the referenced credential and host belong to the requesting user. Version 2.5.1 fixes the issue.