Vulnerability · Published Aug 17, 2026 · Assigned by VulnCheck

CVE-2026-75108Next Terminal Missing Per-Asset Authorization on Portal Endpoints

Medium 5.4

In plain English

A medium-severity missing authorization in next-terminal from next-terminal. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.3%top 77.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Next Terminal fails to enforce per-asset authorization checks on the portal ping and wake-on-LAN endpoints, allowing any authenticated user to probe and wake assets they are not granted access to. Attackers can call these endpoints with arbitrary asset identifiers to retrieve asset information including display names, reachability status, connection timing, and network addresses, or trigger wake-on-LAN packets on unauthorized assets.

Affected products (as reported)

Vendor	Product	Versions
next-terminal	next-terminal	0 – through 3.3.7-b1

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

References

GitHub Issue #573 issue-tracking
https://github.com/next-terminal/next-terminal product
VulnCheck Advisory: Next Terminal Missing Per-Asset Authorization on Portal Endpoints third-party-advisory