Termix is a web‑based server management platform that offers SSH terminal, tunneling, and file editing functionality. In versions before 2.3.2 the POST /database/export endpoint incorrectly included the global settings table in a user‑scoped export. The settings table holds reset_code and temp_reset_token artifacts used in password‑reset operations. A low‑privileged authenticated user can therefore obtain the reset code for another local account, initiate the normal password‑reset flow, and take over that account. If the victim account is an administrator, this results in full administrative compromise, exposing the entire system and its data. This vulnerability allows an attacker to elevate from a low‑privileged user to a high‑privileged user through a local‑to‑remote privilege escalation pathway. The consequence is loss of confidentiality, integrity, and availability for the compromised administrative accounts, and it can enable further lateral movement or full system takeover. Security controls that prevent disclosure of sensitive global settings and enforce strict authorization checks on export functions would mitigate this weakness, which aligns with CWE‑862.

The affected product is Termix, a web‑based server‑management platform provided by Termix‑SSH. All releases prior to version 2.3.2 are impacted. This includes any installation of Termix that permits user‑level access to the database export functionality. The issue is fixed in Termix 2.3.2 and later releases.

The CVSS score for this issue is 8.8, indicating high severity. The EPSS score is currently unavailable, but because the exploit requires only legitimate login credentials and a standard API call, the likelihood of exploitation in the wild is considered moderate to high. The vulnerability is not listed in the CISA KEV catalog. Attackers need only to authenticate as a low‑privileged user with export rights; no additional network or credential access is required. The exploitation path is straightforward: submit a POST request to /database/export, read the returned export to locate reset_code entries, then use those to reset the target user’s password. The attacker becomes a full local user and, if the account is administrative, gains administrative privileges.