Termix-SSH's Termix platform versions prior to 2.6.1 have an improper authorization vulnerability in the GET /host/db/host/:id/password endpoint. The endpoint accepts a numeric host ID and a query parameter requesting either the SSH password or sudo password but does not enforce that the requesting user owns the host. If a requester-scoped lookup fails, the system falls back to resolving the host with the owner's context, returning the owner's plaintext credentials. This allows an authenticated user with a valid JWT to enumerate sequential host IDs and retrieve sensitive credentials belonging to other users, potentially enabling unauthorized access to managed systems. The vulnerability is addressed in version 2.6.1.

An attacker with any valid JWT token can enumerate host IDs and retrieve plaintext SSH or sudo passwords of other users, leading to unauthorized access and control over managed systems outside the Termix platform. This compromises confidentiality and integrity of credentials and systems managed by Termix. The CVSS score of 9.6 reflects the critical severity and the high impact on confidentiality and integrity without requiring user interaction.

Upgrade Termix to version 2.6.1 or later, where this improper authorization vulnerability is fixed. No other mitigation is required as the vendor has provided an official fix.