Termix CVE-2026-79758

Requires a valid authenticated Termix user account on the instance (PR:L) - unauthenticated requests are explicitly blocked. Exploitation targets the server-stats API routes in src/backend/ssh/server-stats.ts: GET /status (returns statuses for hosts the caller cannot access), GET /status/:id (accepts an attacker-supplied numeric host identifier, enabling IDOR enumeration), and POST /clear-connections (lets any regular user clear the global SSH connection pool). No special non-default configuration or user interaction is needed; the defect is present in default multi-user deployments of versions 1.8.0 through pre-2.5.1. The limiting factor is that impact is confined to host online/offline state and lastChecked timestamps (no credential or file contents) plus disruption of sessions/pooled connections, and any authenticated account suffices.

This is a genuine but low-to-moderate priority issue. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L, 5.4 Medium) accurately reflects the impact: network-reachable, low-complexity, but requiring valid authentication (PR:L) and yielding only limited confidentiality (host up/down state and lastChecked timestamps) plus limited availability harm (disrupting other tenants' sessions/pool). No EPSS score, no CISA KEV listing, and no public exploit code are present in the provided intelligence, so there is no signal of active or imminent exploitation - the risk is that of a multi-tenant authorization defect exploitable only by an already-authenticated user. The core signals are consistent (broken authorization confirmed by vendor advisory, PR, and fixing commit); the only conflict is the 'Authentication Bypass' tag, which mislabels the defect - the description is explicit that unauthenticated requests remain blocked and that the failure is loss of per-host/tenant authorization (CWE-284/IDOR), not authentication bypass. Real-world exposure is further bounded by the product's small, self-hosted footprint.

A low-privileged but authenticated user on a shared Termix instance calls GET /status/:id while iterating numeric host identifiers to enumerate which servers other tenants have registered and whether they are online, reading lastChecked timestamps to profile activity. The same user then issues POST /clear-connections to flush the global SSH connection pool, disrupting other users' active sessions. No public exploit code is identified at time of analysis; exploitation is trivial (simple authenticated HTTP requests) but requires an account on the instance.