User Account Recovery Flaw in Termix Web-Based Server Management Platform

CVE-2026-53547

What is CVE-2026-53547?

Termix is a web-based server management platform equipped with SSH terminal, tunneling, and file editing functions. In versions prior to 2.3.2, the platform's POST /database/export endpoint inadvertently exposes the global settings table during user export operations. Although user exports should remain scoped to individual user data, this flaw allows low-privileged authenticated users to retrieve sensitive data such as reset codes and temporary reset tokens linked to other local accounts. By leveraging this information, an attacker can execute a standard password-reset process resulting in the takeover of local user accounts, and potentially compromise administrator accounts if the target is an admin. This issue has been addressed in version 2.3.2.

References