CVE-2026-79758

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-79758
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-79758.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-79758
Aliases
  • GHSA-372w-6f3h-vcm4
Published
2026-09-24T15:57:54Z
Modified
2026-09-26T03:47:40Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L CVSS Calculator
Summary
Termix: Authenticated users can read other users' host status and clear global SSH connections
Details

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.8.0 until 2.5.1, authenticated Termix users can access the server-stats API without per-host authorization. GET /status returns statuses for hosts the requester cannot access, GET /status/:id accepts an attacker-supplied numeric host identifier, and POST /clear-connections permits a regular user to clear the global SSH connection pool. The affected src/backend/ssh/server-stats.ts routes expose host online or offline state and lastChecked timestamps and can disrupt other users' active sessions or pooled connections. Unauthenticated requests remain blocked, but authentication alone does not preserve tenant isolation. This issue is fixed in version 2.5.1.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-284",
        "CWE-639",
        "CWE-862"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/79xxx/CVE-2026-79758.json"
}
References

Affected packages

Git / github.com/termix-ssh/termix

Affected ranges

Type
GIT
Repo
https://github.com/termix-ssh/termix
Events
Introduced
a27d8f264e4436dedeb497242a315cf272af008b
Fixed
ddbdd5c437c2296607dfaa4265d6f63fbc1ca92e
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "1.8.0"
        },
        {
            "fixed":  "2.5.1"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

release-1.*
release-1.10.0-tag
release-1.11.0-tag
release-1.11.1-tag
release-1.11.2-tag
release-1.8.0-tag
release-1.9.0-tag
release-2.*
release-2.0.0-tag
release-2.1.0-tag
release-2.2.0-tag
release-2.2.1-tag
release-2.3.2-tag
release-2.4.0-tag
release-2.4.1-tag
release-2.5.0-tag

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-79758.json"