Termix versions before 2.3.2 contain a missing authorization vulnerability (CWE-862) in the POST /database/export endpoint. This endpoint improperly includes the global settings table in user exports, exposing sensitive password-reset artifacts such as reset_code_ and temp_reset_token_. A low-privileged authenticated user can exploit this to recover another user's reset code and complete the password reset process, leading to local account takeover and administrative compromise if the targeted account has admin privileges. The vulnerability has a CVSS 3.1 score of 8.8, indicating high severity. The issue is resolved in version 2.3.2.

Exploitation allows a low-privileged authenticated user to obtain password reset tokens of other local accounts, enabling account takeover. If the compromised account has administrative privileges, this leads to full administrative compromise of the Termix platform.

Upgrade Termix to version 2.3.2 or later, where this authorization issue in the /database/export endpoint is fixed. No other mitigation is indicated by the vendor advisory.