Termix CVE-2026-53547

The attacker must possess a valid low-privileged authenticated session on the target Termix instance (confirmed by CVSS PR:L). The victim account must be a local account within Termix, as the vulnerability specifically exposes local account password-reset artifacts; accounts authenticated via external identity providers that do not use Termix's native reset flow may not have usable tokens in the settings table. A password-reset token (reset_code_ or temp_reset_token_) must exist in the settings table for the target account at the time of export - this can occur because a reset was previously initiated for that account and not yet completed or cleared. An attacker could increase the likelihood of a token being present by first triggering a password-reset request for the target account (if the reset initiation endpoint does not require authentication or is accessible) before calling the export endpoint. Exploitation is limited to: (1) multi-user Termix deployments, (2) scenarios where local accounts exist alongside or including administrator accounts, and (3) Termix versions prior to 2.3.2. Single-user self-hosted deployments with no other local accounts are not laterally exploitable via this path.

The CVSS 8.8 score (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects the severity: the attack requires only a network-reachable Termix instance and any low-privileged account - no complexity, no user interaction. The administrative compromise scenario elevates the effective impact to near-total system control, justifying C:H/I:H/A:H. No CISA KEV listing and no EPSS data were supplied, so active exploitation is not confirmed. The public GitHub security advisory (GHSA-6r97-7wp3-2g3x) and fix PR #874 make the vulnerability class and mechanism fully disclosed, meaning exploit development is straightforward for any developer familiar with REST API testing. Real-world priority should be HIGH for any multi-tenant Termix deployment or any deployment where local admin accounts coexist with lower-privileged users. Single-user self-hosted instances face minimal lateral risk but are still exposed to the export data leak itself. No conflicting signals: CVSS vector and description are consistent.

An attacker with a legitimate low-privileged Termix account sends a POST request to /database/export to trigger a database dump. They parse the returned export file, locate the global settings table, and extract the reset_code_ or temp_reset_token_ value associated with the administrator account. The attacker then submits that token to the standard password-reset completion endpoint, sets a new password of their choosing, and authenticates as the administrator - gaining full control over the Termix platform and all managed servers.