CVE-2026-45743: Termix Authorization Bypass in SSH File Manager

Technical summary

The vulnerability is an authorization bypass (CWE-639: Authorization through User-Controlled Key) affecting 16 file-manager API endpoints in Termix versions prior to 2.3.2. These endpoints accept a `sessionId` parameter to identify which SSH session a file operation applies to, but fail to validate that the authenticated user making the request actually owns that session. An attacker with valid Termix credentials can enumerate or brute-force active session IDs—potentially low-entropy or sequential—and invoke file operations (read, write, delete, download, execute) on any victim's connected SSH host without the victim's knowledge or consent. The attack requires network access to Termix and valid authentication credentials, but no interaction with the target SSH host itself.

Business impact

Organizations using Termix for team-based SSH management face significant data theft and integrity risks. An employee with legitimate Termix access (or an external attacker who has compromised one employee's credentials) can silently exfiltrate sensitive data from colleagues' connected servers, plant backdoors or malware, destroy logs or production data, or trigger destructive commands. This is particularly damaging in shared DevOps, infrastructure, or cloud-management environments where multiple users connect to the same critical hosts. Incident response is complicated because the attacker's actions appear to originate from a legitimate SSH session, obscuring the true origin. Compliance violations (data loss, unauthorized modification) are likely for regulated industries.

Affected systems

Termix versions prior to 2.3.2 are affected. All deployments of Termix in that version range are at risk if they have multiple users with active SSH sessions. The vulnerability applies to any SSH host that users connect to via Termix; the SSH host itself does not need to be outdated or misconfigured. Termix installations in air-gapped or internal-only networks are not immune—insider threats or lateral movement by a compromised employee remains a viable attack path.

Exploitability

Exploitability is moderately straightforward. An attacker needs valid Termix credentials (not elevated privilege; a regular user account suffices), which may be obtained through credential compromise, insider threat, or social engineering. Session ID enumeration or brute-force is the main technical hurdle; if session IDs are poorly randomized or predictable, exploitation becomes trivial. No interaction with the victim is required, no user-controlled choice needs to be made, and no complex conditions need to be met—just sending a file-manager API request with a guessed `sessionId`. The CVSS score of 8.1 (HIGH) reflects low attack complexity, low privilege requirement, and high impact on confidentiality and integrity, though availability of the Termix service itself is not directly affected.

Remediation

Immediately upgrade Termix to version 2.3.2 or later. This is the only remediation provided by the vendor. Do not wait for a scheduled maintenance window if Termix is used for critical infrastructure access. For organizations unable to patch immediately, enforce strict network segmentation (Termix should be accessible only to trusted users and networks), implement IP whitelisting or VPN-only access to Termix, monitor and log all file-manager API requests for anomalies, and disable Termix features if they are not actively used. However, these controls are temporary; patching is mandatory.

Patch guidance

Upgrade to Termix version 2.3.2 or later. Verify the patch against the Termix vendor advisory to confirm the version number and any associated release notes. Test the upgrade in a non-production environment first to ensure compatibility with your workflows and any customizations. After patching, restart Termix services and any dependent applications. Confirm that active SSH sessions remain functional and that file-manager operations complete successfully. No database migrations or configuration changes are mentioned in the patch; however, review the vendor advisory for any specific post-upgrade steps. If you are running a version between the earliest released version and 2.3.2, you are affected and must patch.

Detection guidance

Monitor Termix API access logs for anomalies: (1) file-manager endpoints being invoked by users for sessions they did not initiate, (2) rapid or sequential `sessionId` values in requests (suggesting enumeration), (3) file operations (delete, execute) on sessions belonging to other users, (4) access patterns that deviate from normal behavior (e.g., a user suddenly accessing a session from a different geographic location or IP). Implement alerting on failed file-manager requests with mismatched `sessionId` ownership. Audit active SSH sessions and their associated users to identify orphaned or compromised sessions. Cross-reference Termix audit logs with SSH host logs to identify file operations that do not correlate with the expected user. Note that if the attacker is careful, detection may be limited to Termix-side logs; SSH host logs will show the hijacked user's credentials, not the attacker's.

Why prioritize this

This vulnerability should be prioritized for immediate patching due to the combination of moderate exploitability (requires valid credentials but straightforward enumeration/brute-force of session IDs), high impact (full file access including read, write, delete, execute), and broad applicability to any Termix deployment with multiple concurrent users. The CVSS score of 8.1 and the nature of the flaw (authorization bypass on critical file operations) make it a high-risk issue. If Termix is used for production infrastructure or sensitive data access, this is a critical patch. Even if Termix is used only for non-sensitive administration, the ability to hijack and impersonate another user's session is a significant security control failure that undermines trust in the platform.

Risk score, explained

CVE-2026-45743 has a CVSS 3.1 score of 8.1 (HIGH) based on the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. This reflects: (1) Network-accessible attack vector (AV:N) — no physical access needed; (2) Low attack complexity (AC:L) — no special conditions or timing required; (3) Low privilege requirement (PR:L) — a standard authenticated user can exploit it; (4) No user interaction (UI:N) — the victim need not click a link or take action; (5) Unchanged scope (S:U) — the attacker does not escape Termix's security perimeter to compromise other systems, but (6) High confidentiality and integrity impact (C:H, I:H) — full read and write access to files on the victim's SSH host; (7) No availability impact (A:N) — the SSH host itself remains functional. The score accurately captures a serious but not critical flaw—it is below the 9.0 threshold for CRITICAL, but well above the 5.5 baseline for MEDIUM.

Frequently asked questions