CVE-2026-53547
HighCVSS 8.8Summary
In Termix before 2.3.2, the POST /database/export endpoint creates a user export that includes the global settings table even though the rest of the export is user-scoped. The settings table contains password-reset artifacts, allowing a low-privileged authenticated user to recover another account's reset code and complete the password-reset flow. Successful exploitation results in local-user account takeover and administrative compromise when the victim is an administrator.
Risk Assessment
The risk includes account takeover, including administrators, potentially leading to full system compromise and data confidentiality breach.
Recommendation
Upgrade Termix to version 2.3.2 or later. Also restrict access to the export endpoint and remove sensitive data from exports.
Original NVD description (English source)
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the POST /database/export endpoint creates a user export that includes the global settings table even though the rest of the export is user-scoped. The settings table contains reset_code_ and temp_reset_token_ password-reset artifacts, allowing a low-privileged authenticated user to recover another local account's reset code and complete the normal password-reset flow. Successful exploitation results in local-user account takeover and administrative compromise when the victim is an administrator. This issue is fixed in version 2.3.2.