Termix up to 2.6.0 Host Password Endpoint host.ts id/field access control

Summaryinfo

A vulnerability classified as problematic was found in Termix up to 2.6.0. Impacted is an unknown function of the file src/backend/database/routes/host.ts of the component Host Password Endpoint. Executing a manipulation of the argument id/field can lead to access control. This vulnerability is tracked as CVE-2026-53548. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability was found in Termix up to 2.6.0. It has been declared as problematic. This vulnerability affects an unknown function of the file src/backend/database/routes/host.ts of the component Host Password Endpoint. The manipulation of the argument id/field with an unknown input leads to a access control vulnerability. The CWE definition for the vulnerability is CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. As an impact it is known to affect confidentiality. CVE summarizes:

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.6.1, the GET /host/db/host/:id/password endpoint in src/backend/database/routes/host.ts accepts an authenticated user's numeric host ID and the field=password or field=sudoPassword query without enforcing host ownership during credential resolution. A failed requester-scoped lookup can resolve the host with the owner's context and return the owner's plaintext credential, allowing any authenticated user with a valid JWT to enumerate sequential hosts.id values and retrieve SSH or sudo passwords belonging to other users. The disclosed credentials can then be used to access and control managed systems outside the Termix instance. This issue is fixed in version 2.6.1.

The advisory is available at github.com. This vulnerability was named CVE-2026-53548 since 06/09/2026. The exploitation appears to be easy. The attack can be initiated remotely. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1068 by the MITRE ATT&CK project.

Upgrading to version 2.6.1 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• Termix

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6.0

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion