CVE-2026-53547

Name of the Vulnerable Software and Affected Versions Termix versions prior to 2.3.2

Description Termix is a web-based server management platform providing SSH terminal, tunneling, and file editing. The 'POST /database/export' endpoint generates a user export that incorrectly includes the global settings table. This table contains password-reset artifacts, specifically the reset code and temp reset token variables. A low-privileged authenticated user can exploit this to recover the reset code of another local account and complete the password-reset process, leading to account takeover and potential administrative compromise if the victim has administrator privileges.

Recommendations Update to version 2.3.2. Restrict access to the 'POST /database/export' endpoint as a temporary mitigation.