Termix EUVD-2026-86199

Requires an authenticated account on the Termix instance (PR:L) - but the description explicitly notes a self-registered account suffices, so the auth barrier is minimal where open registration is enabled. Affected only in versions 2.5.0 up to (not including) 2.5.1; the vulnerable code path is the /homepage/proxy endpoint in homepage-proxy-routes.ts, which existed only in this narrow release window. Exploitation is limited to responses that parse as JSON (the handler JSON.parses the body and rejects non-JSON), and it requires network reachability from the Termix backend to the intended internal/metadata target - highest impact where Termix runs in a cloud environment exposing an instance metadata service (169.254.169.254). No user interaction or elevated privileges are needed.

This is a genuine, well-substantiated SSRF (CWE-918) confirmed by both the vendor security advisory (GHSA-mwr3-35ph-pjqg) and the source-code diff. The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N (7.7) is internally consistent and matches the description: network-reachable, low complexity, requires only a low-privilege or self-registered account, no user interaction, and - critically - the endpoint returns the COMPLETE fetched JSON body, making this a NON-blind SSRF that yields direct confidentiality impact (C:H). This is materially more dangerous than its blind sibling CVE-2026-79760 because attackers see the response, enabling straightforward exfiltration of cloud-metadata credentials (e.g. 169.254.169.254) and internal service data. No EPSS score, KEV listing, or public POC is present in the input, so exploitation is not confirmed in the wild - but the trivial exploitability (a single crafted url query parameter) and the fact that self-registration may be permitted keep real-world risk meaningful wherever Termix is internet-exposed. The main tempering factor is prevalence: Termix is a niche self-hosted OSS product, so this is a real priority for the (small) population running affected instances rather than a broad ecosystem threat. S:C (scope change) is defensible since the attack pivots to and reads other systems (metadata service, internal hosts); a conservative analyst could argue S:U, but it does not change the overall HIGH rating.

An attacker registers or logs into a low-privilege Termix account and calls GET /homepage/proxy with url set to http://169.254.169.254/latest/meta-data/iam/security-credentials/ or an internal service URL. Because new URL performs only syntactic validation with no allowlist or private-range blocking, the backend fetches the target and returns the full JSON response, handing the attacker cloud IAM credentials or internal service data. No public exploit code is identified at time of analysis, but the attack requires only a single crafted query parameter.