CVE-2026-53547: Termix: Account Takeover via Global Settings Disclosure
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the POST /database/export endpoint creates a user export that includes the global settings table even though the rest of the export is user-scoped. The settings table contains resetcode and tempresettoken password-reset artifacts, allowing a low-privileged authenticated user to recover another local account's reset code and complete the normal password-reset flow. Successful exploitation results in local-user account takeover and administrative compromise when the victim is an administrator. This issue is fixed in version 2.3.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Termixto a version that resolves this vulnerability.Fixed in 2.3.2
Event History
Frequently Asked Questions
Who can exploit this issue?
Any low-privileged authenticated Termix user can exploit it. The impact is greatest where another local account, especially an administrator account, has password-reset artifacts stored in the global settings table.
What does an attacker need to take over another account?
The attacker needs valid low-privilege Termix credentials and access to the POST /database/export endpoint. They can recover another account's reset code or temporary reset token from the exported global settings data and use the normal password-reset flow.
Are affected systems exposed by default?
The issue is in the user export behavior of Termix versions prior to 2.3.2: although exports are otherwise user-scoped, the endpoint includes the global settings table. The provided information does not state whether access to this endpoint is restricted or disabled by default.
How can I determine whether my deployment is vulnerable?
Deployments running a Termix version earlier than 2.3.2 are affected. You can also verify exposure by reviewing whether exports generated through POST /database/export contain global settings entries with reset_code_ or temp_reset_token_ password-reset artifacts.
What should be done if patching cannot happen immediately?
The provided information identifies 2.3.2 as the fixed version but does not provide a supported workaround. Until upgrading, limit low-privilege user access to the affected export functionality where possible and treat password-reset artifacts exposed through prior exports as sensitive.