Termix-SSH Termix's POST /credentials/:id/deploy-to-host endpoint improperly authorizes user requests by resolving credentialId and targetHostId parameters without verifying ownership by the requesting user. This leads to an authorization bypass (CWE-639) where attackers can infer the existence of credentials and hosts and cause victim hosts to attempt SSH connections authenticated with the attacker's public key. Passwords and keys remain encrypted and undisclosed. The vulnerability affects versions >=1.7.0 and <2.5.1 and is fixed in 2.5.1.

An attacker with at least limited privileges can bypass authorization checks to cause victim hosts to initiate outbound SSH connections using the attacker's public key. Although sensitive credentials are not exposed, the attacker can glean information about credential and host records and potentially leverage the connection attempt for further actions. The confidentiality impact is limited to information disclosure of record existence and authentication types, with no integrity or availability impact reported.

Upgrade Termix-SSH Termix to version 2.5.1 or later, where this authorization bypass vulnerability is fixed. No other mitigation actions are indicated by the vendor advisory.