CVE-2026-53548
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.6.1, the GET /host/db/host/:id/password endpoint in src/backend/database/routes/host.ts accepts an authenticated user's numeric host ID and the field=password or field=sudoPassword query without enforcing host ownership during credential resolution. A failed requester-scoped lookup can resolve the host with the owner's context and return the owner's plaintext credential, allowing any authenticated user with a valid JWT to enumerate sequential hosts.id values and retrieve SSH or sudo passwords belonging to other users. The disclosed credentials can then be used to access and control managed systems outside the Termix instance. This issue is fixed in version 2.6.1.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.6
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
- EPSS probability
- 0.44%
- CWE
- CWE-285, CWE-639
- Published
- 2026-08-19
- Last modified
- 2026-08-21
Affected products
- Termix-SSH Termix
Weakness type
Related vulnerabilities
- CVE-2026-66422 — Apache Tomcat: Servlet role references can bypass declarative role constraints
- CVE-2026-55166 — Lemur: any SSO-authenticated user achieves AWS IAM compromise and permanent PKI key access via ACME acme_url SSRF and creator-equality IDOR
- CVE-2026-53952 — GetSimple CMS & GetSimpleCMS-CE have an Unauthenticated Admin Account Creation via Setup Logic Flaw
- CVE-2026-73644 — OpenDJ: Authorization bypass in SASL PLAIN allowing a `proxied-auth` holder to impersonate any resolvable non-root user without an ACI proxy grant
- CVE-2026-45052 — OpenAM Pre-auth User Profile Tampering via Anonymous SOAP Authn in Liberty IDPP/Discovery Endpoints
- CVE-2026-48499 — Activepieces: Cross-tenant data exposure and code injection via the Code piece sandbox cache
- CVE-2026-18367 — A privilege escalation vulnerability allows local users to execute arbitrary code as root via Sophos Endpoint for macOS
- CVE-2026-16279 — Improper Authorization vulnerability affecting 3DPassport in 3DSwymer from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026x