CVE-2026-53547

Executive Summary

CVE-2026-53547 is a broken access control vulnerability in Termix, a web-based server management platform providing SSH terminal, tunneling, and file editing capabilities. The flaw exists prior to version 2.3.2, affecting any deployment running an older version, and allows a low-privileged authenticated user to access password-reset artifacts belonging to other local accounts by exploiting a scoping flaw in the user export functionality. Exploitation enables full account takeover, and if the victim is an administrator, complete administrative compromise of the Termix instance. The vulnerability carries a CVSS score of 8.8 (High) with no known public exploit or CISA KEV listing at the time of writing; a vendor patch was released in version 2.3.2.

Technical Analysis

The vulnerability exists in the POST /database/export endpoint of Termix versions prior to 2.3.2. The intended function of this endpoint is to generate a user-scoped export — that is, a backup or dump of data associated with the currently authenticated user's context. However, due to an authorization and scoping defect, the export process improperly includes the contents of a global settings table during export generation, even though all other exported data is scoped to the requesting user.

The global settings table is significant because it stores password-reset artifacts for local accounts, specifically columns or fields named reset_code_ and temp_reset_token_. These artifacts are generated when a user initiates a password reset; they contain the temporary authorization tokens and reset codes that allow completion of the "forgot password" workflow. Under normal circumstances, these artifacts are highly sensitive and should never be exposed outside of the authentication subsystem and the intended account owner.

The authorization flaw — categorized as CWE-862 (Missing Authorization) — stems from the endpoint failing to enforce sufficient access control checks on the global settings data during export generation. A low-privileged authenticated user (e.g., a standard user without administrative rights) who legitimately has access to the /database/export endpoint for their own scoped data will inadvertently receive the global settings table in the same export response. This constitutes an unauthorized disclosure of sensitive authentication material to a non-privileged party.

The attack mechanism is implementation-level: the export routine fails to properly filter or join the global settings table against the user's own scope, instead dumping the entire table into the generated file. Because the reset artifacts (reset_code_ and temp_reset_token_) are stored in plaintext or recoverable form within that table, an attacker who exfiltrates the export can immediately extract reset tokens for any local account that has an active or recent password-reset workflow.

No public technical details beyond the endpoint path and the affected table/column names are available in the NVD description. The underlying database schema, the exact serialization format of the export, and the precise filter logic are not disclosed. Insufficient technical detail is available regarding whether the export is delivered as a downloadable file, returned inline, or transmitted via a background job; however, the attack surface is an authenticated POST request to /database/export.

Exploitation Scenarios

The exploitation chain for CVE-2026-53547 is as follows:

Step 1 — Reconnaissance/Target Identification: An attacker must first obtain valid credentials for a low-privileged local account on a Termix instance (version < 2.3.2). This could be achieved via credential stuffing, phishing, default-password guessing, or prior compromise of a low-privileged user. Alternatively, the attacker may register a new account if self-registration is enabled on the target platform. The attacker then identifies that the target is running Termix by observing the web interface, login portal, or TLS certificates. Shodan searches for "Termix" banners or title tags can enumerate exposed instances.

Step 2 — Flaw Triggering: The attacker authenticates to the Termix web interface using the low-privileged credentials. Once authenticated, the attacker crafts an HTTP POST request to the /database/export endpoint. The request is sent without any special parameters beyond those normally required for a user-scoped export — no elevated privileges, no admin session, and no manipulation of the request body are strictly necessary, because the flaw is in the server-side scoping logic rather than in client-side validation. The attacker submits the request and receives a valid user export.

Step 3 — Payload/Execution: Upon receiving the export, the attacker parses its contents and extracts the global settings table. From this table, the attacker identifies any reset_code_ and temp_reset_token_ values associated with other local accounts, particularly privileged accounts (administrators). The attacker selects a victim account — ideally an administrator — and uses the extracted reset code/token to invoke Termix's standard password-reset flow (e.g., by navigating to the password reset page and supplying the reset code along with a new password chosen by the attacker). Since the reset code/token is a valid artifact from an existing reset workflow, the application accepts it without further validation of the requester's identity.

Step 4 — Post-Exploitation: Successful completion of the password reset grants the attacker full control of the victim's account. If the victim is an administrator, the attacker now holds administrative credentials for Termix, enabling: (a) full read/write access to all managed servers via the SSH terminal functionality, (b) creation of persistent SSH tunnels into the internal network, (c) modification or exfiltration of source code and configuration files edited through the file-editing capability, (d) creation of new backdoor accounts, and (e) potential pivot into the underlying infrastructure of all systems managed by Termix. The attacker can also delete or alter logs to cover traces. Even if the victim is a non-privileged user, account takeover constitutes a credential-theft event that can be leveraged for lateral movement or further intelligence gathering.

No public PoC is currently available for this CVE; the above attack chain is inferred from the vulnerability class (CWE-862 Missing Authorization) and the explicit technical details provided in the NVD description.

Impact Assessment

CVE-2026-53547 carries a CVSS base score of 8.8 (High) with a vector of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The key characteristics are: Attack Vector: Network — the target is remotely exploitable; Attack Complexity: Low — no special conditions or race conditions are required; Privileges Required: Low — only a low-privileged authenticated session is needed; User Interaction: None — no victim interaction required; Scope: Unchanged — the compromise stays within the Termix application's authority boundary.

The confidentiality, integrity, and availability impacts are each rated High. A successful attack results in the disclosure of authentication tokens (confidentiality breach), the ability to change account passwords and take over administrative accounts (integrity breach), and the potential to disrupt service by locking out legitimate administrators or modifying managed-server configurations (availability breach).

The business impact is severe for enterprises that use Termix to manage production servers, since administrative takeover of Termix extends to all connected systems. The blast radius includes: (1) all local accounts on the Termix platform; (2) all servers and infrastructure reachable via the SSH terminal and tunneling features; (3) source code and configuration files managed via the file-editing interface; and (4) any secrets or credentials stored within the platform's database. Organizations hosting Termix on internet-facing networks face the highest risk. The EPSS score has not yet been published by FIRST.org, so no exploit-probability estimate is available; however, the low complexity of exploitation and the high value of the target make active exploitation a realistic near-term threat once tooling matures.

Detection Guidance

Sigma Rule

title: Termix User Export with Global Settings Table Access
id: 4d7f9c1e-8b3a-4e92-9c5f-a1b2d3e4f5a6
status: experimental
description: Detects POST requests to Termix /database/export endpoint from low-privileged users, potentially exploiting CVE-2026-53547 for global settings table disclosure.
author: Valtersit Threat Intelligence
date: 2026/02/15
logsource:
  category: web
  product: termix
detection:
  selection:
    http.method: POST
    http.url|contains: /database/export
    http.user_agent: "*"
  filter_user_admin:
    http.username|contains:
      - admin
      - root
      - administrator
  condition: selection and not filter_user_admin
level: high
tags:
  - attack.t1190
  - cve.2026.53547
  - cwe.862

YARA Rule

rule Termix_Export_Global_Settings
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects Termix export files containing global settings table with password reset tokens"
        date = "2026-02-15"
        cve = "CVE-2026-53547"
        severity = "critical"
    strings:
        $s1 = "reset_code_" ascii nocase
        $s2 = "temp_reset_token_" ascii nocase
        $s3 = "/database/export" ascii
        $s4 = "settings" ascii nocase
    condition:
        uint16(0) == 0x4B50 and all of them
}

Suricata IDS Rule

alert http any any -> any any (msg:"ET EXPLOIT Termix /database/export Endpoint Access by Non-Privileged User (CVE-2026-53547)"; flow:established,to_server; content:"POST"; http_method; content:"/database/export"; http_uri; content:"Cookie"; http_cookie; offset:0; pcre:"/(?i)(session|auth|token)=[a-z0-9]+/"; reference:url,valtersit.com/wordpress/cve-2026-53547; reference:cve,2026-53547; classtype:attempted-user; sid:20265347; rev:1;)

Elastic Detection

sequence by user.id with maxspan=30s
  [ http where request.method == "POST" and url.path == "/database/export" and
    not user.name in ["admin", "root", "administrator"] ]
  [ event.category == "authentication" and (event.action == "password_reset" or 
    winlog.event_id == 4724 or iana_org like "*password*reset*") ]

Splunk SPL Query

index=web sourcetype=access_combined
| where method=="POST" AND uri_path="/database/export"
| search NOT user IN ("admin", "root", "administrator")
| table _time, src_ip, user, uri_path, status
| stats count by src_ip, user
| where count > 5
| eval alert="Termix export used by low-privileged user - possible CVE-2026-53547"

Wazuh OSSEC Rule

<group name="termix,">
  <rule id="202647" level="12" frequency="5">
    <decoded_as>json</decoded_as>
    <field name="url">/database/export</field>
    <field name="method">POST</field>
    <field name="user">!admin</field>
    <field name="user">!root</field>
    <field name="user">!administrator</field>
    <description>Termix export attempt by non-privileged user (CVE-2026-53547)</description>
    <group>cve-2026-53547,cwe-862,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED — no patch evidence from any tracked source. The vendor has not issued an advisory, and no patch has been made publicly available through any tracked channel. An upgrade path to version 2.3.2 exists but the vendor has not confirmed availability via vendor advisory. Organizations should not assume that upgrading to 2.3.2 resolves the issue until the vendor publishes an official advisory.

Immediate Mitigations:

1. Restrict access to the /database/export endpoint using a reverse proxy or web application firewall (WAF) rule: block all POST requests to this path unless originating from an administrative source IP or authenticated admin session.
2. Disable low-privileged user access to the export feature by reviewing role-based access control (RBAC) configuration in Termix; if the platform supports feature-level permissions, remove the export permission from all non-admin roles.
3. Monitor logs for anomalous export activity: repeated /database/export POST requests from non-admin accounts, exports occurring outside business hours, or exports followed by password-reset events.
4. Immediately rotate all local account passwords in Termix and invalidate any pending password-reset tokens; this limits the value of any previously exfiltrated reset artifacts.
5. If self-registration is enabled, disable it to reduce the ability for external attackers to create low-privileged accounts.

Patch/Upgrade Steps:

1. Contact the Termix vendor to confirm the availability and release channel of version 2.3.2 before proceeding with the upgrade.
2. During a planned maintenance window, back up the Termix application data and configuration.
3. Upgrade to version 2.3.2 (or later, if a subsequent release exists) following the vendor's official upgrade documentation.
4. After the upgrade, clear the settings table of any lingering reset_code_ and temp_reset_token_ values by having all users re-initiate (and complete or cancel) their password-reset flows, or by purging the table via the database console if user impact is acceptable.
5. Re-enable low-privileged export permissions only after validating that the scoping fix is effective in a staging environment.

Long-Term Hardening:

1. Implement a security configuration baseline for Termix that restricts the management interface to trusted networks (VPN or private CIDR blocks) rather than the public internet.
2. Harden the platform by disabling unused features (file editing for non-admin roles, tunnel creation for non-admin roles) to reduce the attack surface.
3. Enable comprehensive audit logging on the Termix host and its database, and integrate these logs into the enterprise SIEM for real-time alerting.
4. Conduct periodic reviews of local accounts on Termix, removing stale or unused accounts.
5. Track vendor security advisories closely and apply patches within a defined SLA; given the high CVSS score and low exploitation complexity, prioritize future Termix patches as critical.
6. Apply the principle of least privilege: limit the number of accounts with administrative access, and ensure the admin account itself is a dedicated account not used for daily operations.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-53547 (Valtersit analyst note: NVD currently shows no CNA title or patch data; this is the authoritative source for the description provided.)
2. Vendor Project Page — Termix web-based server management platform: https://termix.dev (listed as the vendor product; no official advisory page is yet available for this CVE.)
3. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-53547 is NOT listed in the KEV catalog at the time of writing; verify periodically for updates.)
4. FIRST EPSS API: https://www.first.org/epss/api (No EPSS score has been published for this CVE; monitor for imminent scoring.)
5. MITRE ATT&CK Technique: https://attack.mitre.org/techniques/T1190/ (Exploit Public-Facing Application — relevant to the attack vector and to the enterprise detection rules above.)

Threat actor campaign evidence: No active threat actor campaigns, exploit-in-the-wild use, or public exploit code have been identified at the time of writing. However, the absence of a publicly available PoC does not preclude targeted exploitation by actors who have reverse-engineered the functionality independently. Security teams are advised to assume that adversaries with knowledge of the endpoint and the scoping flaw can reproduce the attack without external tooling.