CVE-2026-53548 in Termix
Summary
by MITRE • 08/20/2026
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.6.1, the GET /host/db/host/:id/password endpoint in src/backend/database/routes/host.ts accepts an authenticated user's numeric host ID and the field=password or field=sudoPassword query without enforcing host ownership during credential resolution. A failed requester-scoped lookup can resolve the host with the owner's context and return the owner's plaintext credential, allowing any authenticated user with a valid JWT to enumerate sequential hosts.id values and retrieve SSH or sudo passwords belonging to other users. The disclosed credentials can then be used to access and control managed systems outside the Termix instance. This issue is fixed in version 2.6.1.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/20/2026
The vulnerability identified in Termix, a web-based server management platform offering SSH terminal access, tunneling, and file editing capabilities, represents a critical authorization flaw within its credential retrieval mechanism. Specifically affecting versions prior to 2.6.1, this issue resides in the GET /host/db/host/:id/password endpoint located in the src/backend/database/routes/host.ts module. The core technical deficiency lies in the failure of the application logic to enforce strict ownership verification when resolving host credentials. When an authenticated user submits a request containing a numeric host ID along with either field=password or field=sudoPassword query parameters, the backend processes this input without validating that the requesting user is the designated owner of the specified host resource.
This lack of access control allows for a broken object level authorization scenario where any authenticated user possessing a valid JSON Web Token can manipulate sequential host identifiers to enumerate resources across the system. By iterating through numeric IDs, an attacker can systematically probe the database structure and trigger credential resolution logic that defaults to or falls back on resolving the host context using the owner's permissions rather than rejecting unauthorized access attempts. Consequently, this flaw enables the retrieval of plaintext SSH passwords or sudo credentials belonging to other users within the same Termix instance. The absence of proper identity verification during the data fetch operation effectively bypasses intended isolation boundaries between different user accounts and their managed infrastructure assets.
The operational impact of this vulnerability is severe, as it facilitates unauthorized access to external systems that are managed by Termix. Once an attacker obtains these plaintext credentials through enumeration, they can leverage them to establish direct SSH sessions or execute privileged commands on the compromised hosts using sudo privileges. This escalation allows for complete control over the underlying infrastructure, potentially leading to data exfiltration, lateral movement within a network, and further compromise of dependent services. The ability to enumerate sequential IDs also implies that an attacker does not need prior knowledge of specific host identifiers, making automated scanning tools highly effective against this weakness.
From a classification perspective, this vulnerability aligns with CWE-284 Improper Access Control, specifically reflecting issues related to insufficient authorization checks during resource access. It is further categorized under CWE-639 Authorization Bypass Through User-Controlled Key, as the numeric host ID serves as an unguessable but enumerable key that was not properly validated against user ownership. In terms of offensive security frameworks, this behavior maps directly to MITRE ATT&CK technique T1078 Valid Accounts and specifically sub-technique T1078.002 Cloud Accounts if the managed hosts are cloud instances, or generally T1528 Steal Application Access Token for obtaining initial access via JWTs followed by credential harvesting activities associated with lateral movement phases such as T1021 Remote Services.
To mitigate this vulnerability and prevent similar issues in future development cycles, it is imperative to implement robust object-level authorization checks within the backend route handlers. Developers must ensure that every request accessing sensitive resources like credentials verifies that the authenticated user's identity matches the ownership attribute of the requested resource before returning any data. Additionally, implementing rate limiting on credential endpoints can help mitigate enumeration attacks by slowing down rapid sequential requests. Upgrading to version 2.6.1 or later is required as this release contains the necessary patches to enforce proper access controls and resolve the authorization bypass flaw. Regular security audits focusing on API endpoint logic and automated testing for broken object level authorization are recommended to maintain a secure posture in server management platforms handling sensitive infrastructure credentials.