CVE-2026-79759
Received Received - Intake

Authentication Bypass in Termix via IDOR

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: GitHub, Inc.

Description
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, the POST /credentials/:id/deploy-to-host endpoint resolves credential and target-host records from attacker-controlled credentialId and targetHostId integer values without checking that either record belongs to the requesting user. In src/backend/database/routes/credentials.ts, differential errors reveal whether credential and host records exist and disclose each record's authType value. Properly encrypted passwords and keys are not disclosed, but a key-authenticated victim host can receive an outbound SSH connection attempt using the attacker's public key. This issue is fixed in version 2.5.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-25
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-79759
EUVD
EUVD-2026-86160

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
termix termix 2.5.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a cross-user information disclosure flaw in Termix, affecting versions 1.7.0 to 2.5.1. The issue occurs in the POST /credentials/:id/deploy-to-host endpoint, which fails to verify that credential and host records belong to the requesting user. Attackers can exploit this by manipulating integer IDs to infer the existence of other users' credentials and hosts, as well as their authentication types (e.g., password or key-based), through error responses.

Detection Guidance

To detect this vulnerability, monitor logs for unusual POST requests to /credentials/:id/deploy-to-host with sequential or suspicious integer IDs. Check for differential error responses indicating record existence or authType disclosure. Review database query logs for missing user ID filters in credential and host retrieval operations.

Impact Analysis

An attacker could enumerate all sequential IDs in the system, map user credentials and hosts, and trigger SSH connection attempts to victim hosts if they use key-based authentication. The victim's server would log these attempts, potentially revealing the attacker's public key. While passwords and keys remain encrypted, the exposed metadata could aid further attacks.

Compliance Impact

This vulnerability could lead to unauthorized access to user data, violating confidentiality requirements in GDPR and HIPAA. Exposure of authentication metadata and record existence may constitute a data breach, requiring notifications and potential fines under these regulations.

Mitigation Strategies

Upgrade Termix to version 2.5.1 or later to apply the security fix. Ensure all instances of the /credentials/:id/deploy-to-host endpoint enforce user ID checks in database queries. Review and update other endpoints to confirm proper ownership validation is implemented.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-79759. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart