CVE-2026-79758
Received Received - Intake

Termix Unauthorized Host Status Access via API

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: GitHub, Inc.

Description
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.8.0 until 2.5.1, authenticated Termix users can access the server-stats API without per-host authorization. GET /status returns statuses for hosts the requester cannot access, GET /status/:id accepts an attacker-supplied numeric host identifier, and POST /clear-connections permits a regular user to clear the global SSH connection pool. The affected src/backend/ssh/server-stats.ts routes expose host online or offline state and lastChecked timestamps and can disrupt other users' active sessions or pooled connections. Unauthenticated requests remain blocked, but authentication alone does not preserve tenant isolation. This issue is fixed in version 2.5.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-25
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-79758
EUVD
EUVD-2026-86157

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
termix termix From 1.8.0 (inc) to 2.5.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Termix versions 1.8.0 to 2.5.0 have an authorization flaw in the server-stats API. Authenticated users can access host status data and manipulate connections without proper host-level permissions. This allows them to view offline or online states and timestamps of hosts they shouldn't access, and clear global SSH connection pools.

Detection Guidance

Check Termix versions between 1.8.0 and 2.5.0. Inspect API logs for unauthorized /status or /status/:id requests. Monitor for unusual host status queries or connection pool clear operations by authenticated users.

Impact Analysis

An attacker with valid credentials could gather sensitive host information, disrupt active user sessions, or terminate pooled SSH connections. This may lead to service interruptions, unauthorized information exposure, or reduced system reliability for other users.

Compliance Impact

This vulnerability could violate data protection requirements by exposing host status information to unauthorized users. It may compromise tenant isolation, leading to potential breaches of confidentiality under GDPR or unauthorized access to sensitive systems under HIPAA.

Mitigation Strategies

Upgrade Termix to version 2.5.1 or later immediately. Review and restrict API access permissions for authenticated users. Monitor network traffic for suspicious API calls to /status or /clear-connections endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-79758. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart