CVE-2026-45743: Termix has a File-Manager Session Hijack via Missing Ownership Check (IDOR)

Synopsis

This is an Insecure Direct Object Reference (IDOR) vulnerability in Termix, a web-based server management platform. An authenticated attacker who knows or can guess another user's active session ID can call any of 16 file-manager API endpoints without owning that session, because the server performs no ownership check. Successful exploitation gives the attacker full read, write, delete, download, and execute access to files on the victim's connected SSH host. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Termix web application over the network; the vulnerable file-manager endpoints are HTTP-accessible services.

• AuthenticationRequired

  Any low-privilege Termix account is sufficient; the attacker does not need administrator rights, only a valid authenticated session of their own.

• Victim interactionNot required

  No action is required from the victim; the attacker calls the vulnerable endpoints directly without any social-engineering step.

• Attack complexityDetail

  The exploit is reliable and condition-free once the attacker obtains or guesses a target session ID; no race conditions or special memory layout requirements exist.

Blast Radius

• Reads arbitrary files on the victim's connected SSH host, including credentials, private keys, and application configuration.
• Writes or overwrites files on the victim's SSH host, enabling persistent backdoors or configuration tampering.
• Deletes files on the victim's SSH host, which can destroy application data or disrupt running services.
• Executes files on the victim's SSH host through the file-manager execute endpoint, achieving remote code execution in the victim's session context.