CVE-2026-53547

Received Received - Intake

Information Disclosure in Termix Prior to 2.3.2

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the POST /database/export endpoint creates a user export that includes the global settings table even though the rest of the export is user-scoped. The settings table contains reset_code_ and temp_reset_token_ password-reset artifacts, allowing a low-privileged authenticated user to recover another local account's reset code and complete the normal password-reset flow. Successful exploitation results in local-user account takeover and administrative compromise when the victim is an administrator. This issue is fixed in version 2.3.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-53547

EUVD

EUVD-2026-62856

Affected Vendors & Products

Vendor	Product	Version / Range
termix	termix	2.3.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

Termix before version 2.3.2 has a vulnerability in the POST /database/export endpoint. It exports the global settings table, which contains password-reset artifacts like reset codes and temporary tokens. A low-privileged authenticated user can access these artifacts and use them to reset another user's password, leading to account takeover. If the victim is an administrator, this can result in full system compromise.

Detection Guidance

Check Termix version with curl http://<target>/version or inspect the /database/export endpoint for global settings table inclusion in exports. Verify if reset_code_ or temp_reset_token_ fields are exposed in user exports.

Impact Analysis

If you use Termix before version 2.3.2, an attacker with low-level access could exploit this to take over your account or any other local account, including administrator accounts. This could allow the attacker to gain full control over the Termix server and its managed systems.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements under GDPR and HIPAA. GDPR requires protecting personal data, while HIPAA mandates securing protected health information. Account takeover could result in data breaches, leading to legal penalties and reputational damage.

Mitigation Strategies

Upgrade Termix to version 2.3.2 or later immediately. If upgrading is not possible, restrict access to the /database/export endpoint and review user exports for exposed reset tokens.

Hi! I’m here to help you understand CVE-2026-53547. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70