High severity7.2NVD Advisory· Published Nov 11, 2026
CVE-2026-126803
CVE-2026-126803
Description
Rote through 2.6.0 contains a privilege escalation vulnerability that allows authenticated admins to obtain super_admin rights by reading or overwriting JWT signing secrets via /v2/api/admin/settings. Attackers can retrieve the unmasked jwtSecret from the security settings group and forge HS256 tokens for the super administrator to change user roles and escalate their own account.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2Patches
Vulnerability mechanics
References
5- github.com/Rabithua/Rote/blob/v2.6.0/server/route/v2/admin.tsnvd
- github.com/Rabithua/Rote/commit/865d69fceb9c1f1a0d30923fae7cef072a38b22bnvd
- github.com/Rabithua/Rote/pull/420nvd
- vul.yulun.ac.cn/20261104/rote/nvd
- www.vulncheck.com/advisories/rote-through-2.6.0-privilege-escalation-via-admin-settings-api-jwt-secret-exposurenvd
News mentions
0No linked articles in our index yet.