Vulnerability Description
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.8.0 until 2.5.1, authenticated Termix users can access the server-stats API without per-host authorization. GET /status returns statuses for hosts the requester cannot access, GET /status/:id accepts an attacker-supplied numeric host identifier, and POST /clear-connections permits a regular user to clear the global SSH connection pool. The affected src/backend/ssh/server-stats.ts routes expose host online or offline state and lastChecked timestamps and can disrupt other users' active sessions or pooled connections. Unauthenticated requests remain blocked, but authentication alone does not preserve tenant isolation. This issue is fixed in version 2.5.1.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/Termix-SSH/Termix/commit/ddbdd5c437c2296607dfaa4265d6f63fbc1c
- https://github.com/Termix-SSH/Termix/pull/1067
- https://github.com/Termix-SSH/Termix/releases/tag/release-2.5.1-tag
- https://github.com/Termix-SSH/Termix/security/advisories/GHSA-372w-6f3h-vcm4
- https://github.com/Termix-SSH/Termix/security/advisories/GHSA-372w-6f3h-vcm4
FAQ
What is CVE-2026-79758?
CVE-2026-79758 is a vulnerability with a CVSS score of 5.4 (MEDIUM). Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.8.0 until 2.5.1, authenticated Termix users can access the server-stats API without...
How severe is CVE-2026-79758?
CVE-2026-79758 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-79758?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.