Termix EUVD-2026-86160

Requires an authenticated Termix account (PR:L) with access to the POST /credentials/:id/deploy-to-host endpoint on any instance running versions 1.7.0 through 2.5.0. No user interaction, special configuration, or admin privileges are needed - any logged-in user can enumerate other users' credential and host record IDs. Exploitation is LIMITED to information disclosure of record existence and authType plus triggering a (non-authenticating) outbound SSH attempt with the attacker's public key; encrypted passwords and private keys remain protected and are never disclosed, capping real-world impact.

This is a genuine but low-severity issue, consistent with its CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). The vector requires an authenticated Termix user (PR:L) but no user interaction, and the impact is limited to confidentiality (C:L) - the flaw is a classic CWE-639 IDOR/BOLA where the deploy-to-host endpoint trusts attacker-supplied credentialId/targetHostId integers without ownership checks. No EPSS score, KEV listing, or public POC is present in the input, so there is no signal of active or imminent exploitation. Importantly, the vendor advisory explicitly states encrypted passwords and private keys are NOT disclosed; the leak is limited to record existence, the authType field, and the ability to trigger an outbound SSH connection attempt to a victim host using the attacker's own public key (which cannot authenticate). No SSVC decision data was provided. The 'Authentication Bypass' tag overstates the issue - this is broken object-level authorization by an already-authenticated user, not an auth bypass. Net: a real, patch-worthy access-control defect, but not a priority for emergency remediation.

An authenticated low-privilege Termix user sends POST /credentials/:id/deploy-to-host requests iterating over sequential credentialId and targetHostId integers belonging to other users. Differential error responses reveal which credential and host records exist and expose each record's authType, and against a key-authenticated victim host the server initiates an outbound SSH connection attempt carrying the attacker's public key. No public exploit code is identified at time of analysis; the technique is trivial (simple ID enumeration) but yields only metadata, not credential contents.