CVE-2026-53548

Name of the Vulnerable Software and Affected Versions Termix versions prior to 2.6.1

Description An issue exists in the GET /host/db/host/:id/password endpoint within src/backend/database/routes/host.ts where host ownership is not enforced during credential resolution. When an authenticated user provides a numeric host ID and the field=password or field=sudoPassword query, a failed requester-scoped lookup may resolve the host using the owner's context. This allows any authenticated user with a valid JSON Web Token (JWT)—a compact, URL-safe means of representing claims to be verified and trusted between two parties—to enumerate sequential hosts.id values and retrieve plaintext SSH or sudo passwords belonging to other users. These credentials can be used to gain unauthorized access and control over managed systems outside the platform.

Recommendations Update to version 2.6.1. Avoid using the field=password and field=sudoPassword parameters in the /host/db/host/:id/password endpoint until the update is applied.