CVE-2026-53547: Termix Auth Bypass Vulnerability

CVE-2026-53547 Overview

CVE-2026-53547 is a missing authorization vulnerability [CWE-862] in Termix, a web-based server management platform providing SSH terminal, tunneling, and file editing capabilities. Versions prior to 2.3.2 expose password-reset artifacts through the POST /database/export endpoint. The user export unexpectedly includes the global settings table, which stores reset_code_ and temp_reset_token_ values for all local accounts. A low-privileged authenticated user can extract another account's reset code and complete the standard password-reset flow, resulting in account takeover.

Critical Impact
Authenticated attackers can hijack administrator accounts by retrieving reset codes exposed in user-scoped database exports.

Affected Products

Termix versions prior to 2.3.2
Termix SSH web-based server management platform
Termix installations exposing the /database/export endpoint

Discovery Timeline

2026-08-19 - CVE-2026-53547 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-53547

Vulnerability Analysis

The flaw resides in Termix's POST /database/export endpoint. This endpoint is intended to produce a user-scoped export containing only the authenticated caller's data. However, the export routine also serializes the global settings table without filtering by user ownership. The settings table stores password-reset state for every local account, including reset_code_ and temp_reset_token_ fields.

Any authenticated user who invokes the export can read these artifacts from the response. If a password reset has been initiated for another user, or if the attacker triggers one against a target account, the reset code becomes retrievable. The attacker then completes the normal password-reset flow with the recovered code and gains control of the victim account. When the victim is an administrator, this yields administrative compromise of the Termix instance.

Root Cause

The root cause is a missing authorization check [CWE-862] on data included in the export. The endpoint scopes user tables correctly but treats the global settings table as safe to include verbatim. Sensitive password-reset material stored in that table is therefore returned to any authenticated caller.

Attack Vector

Exploitation requires network access to the Termix web interface and a valid low-privileged account. The attacker authenticates, issues a POST request to /database/export, and parses the returned export for reset_code_ and temp_reset_token_ entries associated with a target user. The attacker then invokes the standard password-reset endpoint using the recovered code to set a new password on the victim account.

See the GitHub Security Advisory GHSA-6r97-7wp3-2g3x for the coordinated disclosure details and the upstream fix commit that ships in release 2.3.2.

Detection Methods for CVE-2026-53547

Indicators of Compromise

Unexpected POST requests to /database/export from non-administrator accounts.
Password-reset completions immediately following an export request from a different user session.
New or altered administrator credentials without a corresponding legitimate reset request.
Session activity from a low-privileged user shortly before privileged actions occur on another account.

Detection Strategies

Alert on any invocation of POST /database/export and correlate with the authenticated user's role.
Monitor password-reset endpoint calls that succeed without a preceding user-initiated reset request from the victim.
Compare source IP and user-agent between the reset request initiator and the account owner's normal sessions.

Monitoring Recommendations

Enable verbose application logging for authentication, export, and reset-flow endpoints.
Forward Termix web and application logs to a centralized SIEM for correlation across users.
Track administrator account changes and require out-of-band confirmation of password resets.

How to Mitigate CVE-2026-53547

Immediate Actions Required

Upgrade Termix to version 2.3.2 or later without delay.
Rotate credentials for all local accounts, prioritizing administrators, after upgrading.
Invalidate any outstanding reset_code_ and temp_reset_token_ values in the settings table.
Review historical logs for prior calls to /database/export by non-administrators.

Patch Information

The issue is fixed in Termix release 2.3.2. The upstream fix is delivered through Pull Request #874 and the security patch commit. Administrators should apply the release rather than attempt manual backports.

text

 lerna-debug.log*
 
 node_modules
+src/mcp-server/node_modules
 dist
 dist-ssr
+coverage
 *.local
 
 .vscode/

Source: GitHub Commit 52f4e51

The repository-level changes shipped alongside the fix adjust build hygiene files such as .gitignore and .prettierignore. The authorization logic change that removes the settings table from user exports is contained in the same release; refer to the advisory for the specific server-side changes.

Workarounds

Restrict network access to the Termix web interface to trusted administrators until the patch is applied.
Disable or block the /database/export route at a reverse proxy for non-administrator sessions.
Force a global password reset and invalidate active sessions after patching.

bash

# Example reverse-proxy restriction (nginx) blocking export access pre-upgrade
location = /database/export {
    allow 10.0.0.0/24;   # admin management network
    deny all;
    proxy_pass http://termix_upstream;
}