The vulnerability arises from missing per-host authorization checks in Termix’s server-stats API routes. Authenticated users can invoke GET /status, GET /status/:id, and POST /clear-connections to retrieve the online/offline state and lastChecked timestamps of hosts they are not permitted to view, and to terminate all active SSH connections in the global pool. This enables users to glean sensitive operational details about other tenants and to disrupt their active sessions, leading to information disclosure and service interruption. The weakness aligns with CWE‑284 (Improper Access Control), CWE‑639 (Authorization Bypass Through User-Controlled Key) and CWE‑862 (Missing Authorization).

Affected systems are instances of Termix‑SSH Termix software from release 1.8.0 up to but excluding 2.5.1. The issue was fixed in version 2.5.1, so any deployment running a lower version in the stated range is vulnerable. Administrators should verify the exact build and plan an upgrade if required.

With a CVSS score of 5.4 the vulnerability carries a moderate severity. Because it requires authentication and the service is web‑based, the attack surface is limited to users with legitimate access to the Termix UI. EPSS data is not available, and the vulnerability is not listed in CISA's KEV catalog, indicating no publicly known exploits at this time. Nonetheless, an attacker who can compromise a user account can inject host identifiers to enumerate hosts and can issue a clear‑connections command to disrupt other users’ SSH sessions.