CVE-2026-79758 Details
Description
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.8.0 until 2.5.1, authenticated Termix users can access the server-stats API without per-host authorization. GET /status returns statuses for hosts the requester cannot access, GET /status/:id accepts an attacker-supplied numeric host identifier, and POST /clear-connections permits a regular user to clear the global SSH connection pool. The affected src/backend/ssh/server-stats.ts routes expose host online or offline state and lastChecked timestamps and can disrupt other users' active sessions or pooled connections. Unauthenticated requests remain blocked, but authentication alone does not preserve tenant isolation. This issue is fixed in version 2.5.1.
A cross-user authorization vulnerability has been identified in Termix, a web-based server management platform, affecting versions 1.8.0 prior to 2.5.1. This vulnerability allows authenticated users to access the server-stats API without proper authorization for each host. The issue arises because the server-stats routes do not verify host ownership or access rights before disclosing information or performing actions. As a result, users can read the status of hosts they do not own and disrupt other users' SSH connections by clearing the global connection pool.
Users can update to Termix version 2.5.1 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 24, 2026CISA-ADP
Assessed Sep 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Termix-SSH/Termix/security/advisories/GHSA-372w-6f3h-vcm4 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/Termix-SSH/Termix/commit/ddbdd5c437c2296607dfaa4265d6f63fbc1ca92e | [email protected] | Source CodeVendor |
| https://github.com/Termix-SSH/Termix/pull/1067 | [email protected] | Source CodeVendor |
| https://github.com/Termix-SSH/Termix/releases/tag/release-2.5.1-tag | [email protected] | Release NotesVendor |
| https://github.com/Termix-SSH/Termix/security/advisories/GHSA-372w-6f3h-vcm4 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-284 | Improper Access Control | [email protected] |
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Termix | >= 1.8.0, < 2.5.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 24, 2026 | CVE Modified | CISA-ADP |
| Sep 24, 2026 | New CVE Received | [email protected] |