This vulnerability is an authorization bypass where credential retrieval silently falls back to the resource owner's context when the requester's scope doesn't match. The lookup logic was designed to be 'helpful' — it tries the requester's scope first, then gracefully falls back to the owner's context if the resource isn't found in the requester's domain. This prevents noisy 404s when data exists but the lookup context is slightly wrong. For most data types, that's reasonable UX. For credentials, it's catastrophic: any silent fallback is an authorization bypass by definition.
The attack is trivial to execute. A valid JWT authenticates you as a legitimate user. Sequential integer enumeration of host IDs returns credentials for hosts you should never see. The blast radius extends far beyond the Termix instance itself — you get SSH credentials to infrastructure discoverable via Shodan. This isn't a sophisticated exploit; it's a composition failure where a generic lookup utility with tolerance semantics was adopted by a privileged operation without auditing whether that tolerance is a liability.
Worse, this vulnerability leaves no trace. No 404s, no error spikes, no failed auth logs. Every detection mechanism that assumes authorization failures are visible was blind to this bypass. That's why it survived into a released version — the fallback didn't just cause the bypass, it concealed the bypass.
The fix in 2.6.1 presumably hard-gates credential resolution. But ask yourself: how many OTHER endpoints in this codebase use the same lookup helper with the same fallback tolerance? This vulnerability is one expression of a class — the pattern of 'generic lookup utility adopted by privileged operations without security auditing' has appeared in CVE families going back over a decade. Structural fixes only stick if the team develops a threat model for their utility patterns: every lookup helper that returns data should have a layer that asks 'should this generic lookup ever touch credential fields?' before execution. Without that, the next helpful fallback gets added and the cycle repeats.