A missing ownership check in the POST /credentials/:id/deploy-to-host endpoint allows an authenticated user to supply arbitrary credential and host identifiers. The endpoint returns errors that reveal whether specified credential or host records exist and discloses each record’s authentication type. Although actual credentials are not exposed, the leaked authType values enable information gathering and a key‑authenticated victim host can be caused to accept the attacker’s public key. The vulnerability is a classic ownership verification flaw (CWE‑639) and leads to cross‑user information disclosure and potential side‑channel SSH connection attempts.

Termix versions 1.7.0 through 2.5.1 expose the vulnerable endpoint on any reachable deployment. All instances of Termix‑SSH running these releases are impacted, regardless of deployment environment.

With a CVSS score of 4.3, the issue carries moderate severity. An attacker with legitimate web‑interface access can target the endpoint to gain privileged information. No EPSS score is available and the flaw is not listed in the CISA KEV catalog, indicating limited known exploitation. Nonetheless, the lack of proper ownership checks presents a meaningful risk, especially in multi‑user contexts.