CVE-2026-79759

Name of the Vulnerable Software and Affected Versions Termix versions 1.7.0 through 2.5.0

Description Termix is a web-based server management platform providing SSH terminal, tunneling, and file editing. The POST '/credentials/:id/deploy-to-host' endpoint fails to verify if the records associated with the credentialId and targetHostId integer values belong to the requesting user. Additionally, differential errors in src/backend/database/routes/credentials.ts can reveal the existence of credential and host records and disclose their authType values. While encrypted passwords and keys remain protected, a victim host using key authentication may receive an outbound SSH connection attempt utilizing the attacker's public key.

Recommendations Update to version 2.5.1.