What is the CVSS score of CVE-2026-45746?

CVE-2026-45746 has a CVSS 3.1 base score of 9.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Termix are affected by CVE-2026-45746?

Termix versions prior to 2.3.2 enable authenticated users to hijack other users' active sessions, providing direct access to customers' remote infrastructure and data.. A patch is available.

How to fix or mitigate CVE-2026-45746?

Within 24 hours: disable the File Manager feature or restrict access to trusted, monitored systems; notify all Termix users of the session hijacking risk. Within 7 days: implement network segmentation between Termix clients and production infrastructure; deploy monitoring for anomalous session activity (sequential sessionId patterns, out-of-order requests). Within 30 days: maintain heightened monitoring; prepare deployment procedures for vendor patches when available; conduct full audit of Termix access logs for exploitation indicators.

Termix CVE-2026-45746

EUVD-2026-34874 CRITICAL

Improper Access Control (CWE-284)

2026-06-05 GitHub_M

Authentication Bypass Termix

9.0

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.0 CRITICAL

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 05, 2026 - 20:02 EUVD

Analysis Generated

Jun 05, 2026 - 18:36 vuln.today

DescriptionGitHub Advisory

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.3.2, the File Manager functionality in Termix contains a critical Broken Access Control vulnerability due to improper validation of the sessionId parameter. The backend trusts a client-controlled identifier without verifying that it belongs to the authenticated user. This allows an attacker to manipulate the value and access active File Manager sessions belonging to other users. Since these sessions are tied to SSH connections to remote VPS instances, exploitation allows unauthorized interaction with another user's remote filesystem. Because the File Manager exposes functionality such as file reading, writing, uploading, and execution, this vulnerability enables direct command execution on another user's VPS (RCE). Version 2.3.2 patches the issue.

AnalysisAI

Cross-tenant remote code execution in Termix (web-based SSH/file management platform) prior to version 2.3.2 allows an authenticated low-privileged user to hijack another user's active File Manager session by tampering with a client-supplied sessionId, gaining full read/write/execute access to that victim's remote VPS over their established SSH connection. The CVSS 9.0 score reflects scope change (the compromised session crosses the trust boundary into the victim's separate VPS) and high impact across CIA. No public exploit is identified at time of analysis and the issue is not listed in CISA KEV, but the trivial nature of incrementing/guessing an unvalidated identifier makes exploitation straightforward once a foothold account exists.

Technical ContextAI

Termix is a self-hosted web platform (CPE cpe:2.3:a:termix-ssh:termix) that brokers SSH terminals, port-forward tunnels, and a File Manager backed by long-lived SSH sessions to user-supplied VPS instances. The flaw is a CWE-284 (Improper Access Control) issue: the File Manager backend uses a sessionId received from the client as the sole index for routing file operations to an underlying SSH channel, without checking that the sessionId is owned by the authenticated principal making the request. Because each sessionId is bound to a live SSH connection with full filesystem and shell capabilities on a remote host, the missing ownership check effectively turns a session identifier into a bearer token for somebody else's VPS - and because filesystem operations include write and execute, the access-control failure escalates trivially to RCE on the victim's remote machine.

RemediationAI

Vendor-released patch: upgrade Termix to version 2.3.2 or later, per advisory GHSA-cx2r-843c-vww8 (https://github.com/Termix-SSH/Termix/security/advisories/GHSA-cx2r-843c-vww8). If immediate upgrade is not possible, restrict Termix to single-tenant use (one trusted user per instance) so cross-tenant session hijacking has no victim, or place the Termix UI behind an authenticating reverse proxy with per-user network segmentation; both trade off the multi-user collaboration model that Termix is designed for. Additionally invalidate all existing File Manager sessions after upgrade and rotate SSH credentials stored in Termix for any account that may have shared an instance with untrusted users, since pre-patch session hijacks would have given attackers interactive shell access on the targeted VPS.