CVE-2026-53547

HIGH 8.8

Termix: Account Takeover via Global Settings Disclosure

CVSS Score

8.8

EPSS Score

0.0%

EPSS Percentile

0th

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the POST /database/export endpoint creates a user export that includes the global settings table even though the rest of the export is user-scoped. The settings table contains reset_code_ and temp_reset_token_ password-reset artifacts, allowing a low-privileged authenticated user to recover another local account's reset code and complete the normal password-reset flow. Successful exploitation results in local-user account takeover and administrative compromise when the victim is an administrator. This issue is fixed in version 2.3.2.

CWE	CWE-862
Vendor	termix-ssh
Product	termix
Published	Aug 19, 2026

Stay Ahead of the Next One

Get instant alerts for termix-ssh termix

Be the first to know when new high vulnerabilities affecting termix-ssh termix are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

Termix-SSH / Termix

< 2.3.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/Termix-SSH/Termix/security/advisories/GHSA-6r97-7wp3-2g3x github.com: https://github.com/Termix-SSH/Termix/pull/874 github.com: https://github.com/Termix-SSH/Termix/commit/52f4e51ae03b5b8d2608e1383e2ccf79d290132b github.com: https://github.com/Termix-SSH/Termix/releases/tag/release-2.3.2-tag