Termix is a web-based server management platform that includes an SSH terminal feature. In versions before 2.3.2, the terminal WebSocket accepts a user-controlled hostConfig.id, which is resolved without verifying ownership or explicit access rights. When no credential is shared with the requester, the system falls back to using the owner's credential. The terminal then combines this credential with attacker-controlled IP, port, and username values. This flaw allows an authenticated low-privileged user to cause Termix to authenticate to an attacker-controlled SSH server, resulting in the disclosure of another user's stored SSH password or private key material while the victim's data key is unlocked. The vulnerability is identified as CWE-639 (Authorization Bypass Through User-Controlled Key) and CWE-862 (Missing Authorization). It has a CVSS 3.1 score of 9.6 (critical). The issue is resolved in Termix version 2.3.2.

An authenticated low-privileged user can bypass authorization controls to access another user's stored SSH credentials, including passwords and private keys. This leads to a complete compromise of confidentiality for those credentials, potentially allowing unauthorized access to SSH servers as the victim user. The vulnerability does not impact availability but has high confidentiality and integrity impacts.

Upgrade Termix to version 2.3.2 or later, where this authorization bypass vulnerability is fixed. No other mitigations are indicated. Patch status is confirmed fixed in 2.3.2.