Description

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the POST /database/export endpoint creates a user export that includes the global settings table even though the rest of the export is user-scoped. The settings table contains reset_code_ and temp_reset_token_ password-reset artifacts, allowing a low-privileged authenticated user to recover another local account's reset code and complete the normal password-reset flow. Successful exploitation results in local-user account takeover and administrative compromise when the victim is an administrator. This issue is fixed in version 2.3.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-19T21:16:56.843Z",
  "pubdate": "2026-08-19T21:16:56.843Z",
  "executiveSummary": "An improper data exposure vulnerability exists in Termix prior to version 2.3.2.\nThe vulnerability resides within the POST /database/export endpoint, which incorrectly exposes sensitive authentication artifacts from the global settings table during a user-scoped export operation.\nA low-privileged authenticated attacker can exploit this flaw to retrieve sensitive reset_code_ and temp_reset_token_ password-reset artifacts belonging to other local accounts.\nSuccessful exploitation enables unauthorized password resets, leading to local-user account takeover and potential administrative compromise if the targeted victim holds administrative privileges.\nThe attack requires low-privileged authentication and network access to the web-based server management platform.\nRisk implications include complete confidentiality loss of sensitive authentication state data and severe integrity compromise of user and administrative accounts within the application domain.",
  "technicalDetails": "The vulnerability is caused by an authorization and data-scoping enforcement failure in the export functionality of Termix prior to version 2.3.2.\nThe vulnerable component is the POST /database/export endpoint, which is designed to generate user-scoped database exports.\nWhile the majority of the export payload correctly respects user boundaries, the generation logic inadvertently includes the global settings table.\nThe global settings table contains critical security artifacts, specifically reset_code_ and temp_reset_token_ parameters associated with the application's password-reset mechanism.\nAuthentication requirements dictate that the attacker must possess a valid, low-privileged authenticated session to issue requests to the vulnerable POST /database/export endpoint.\nThe attack flow proceeds as follows: First, the low-privileged authenticated user sends a POST request to the /database/export endpoint. Second, the server processes the export generation, improperly pulling records from the global settings table alongside the expected user-scoped data. Third, the resulting export package is returned to the user containing the sensitive password-reset artifacts of other accounts. Fourth, the attacker parses the exported data to extract the reset_code_ and temp_reset_token_ values for a targeted victim. Fifth, the attacker leverages these artifacts to complete the normal password-reset flow for the targeted account.\nPost-exploitation impact includes unauthorized local-user account takeover. If the targeted victim is an administrator, this results in a complete administrative compromise of the Termix web-based server management platform, granting full control over server management capabilities, SSH terminal access, tunneling configurations, and file editing features."
}