ROTE · CVE-2026-126803 · Other
NO FIX YET · SEE WHAT TO DO
Rote through version 2.6.0 exposes the unmasked JWT signing secret through its admin settings API. An authenticated admin can read or overwrite that secret, forge HS256 tokens for the super administrator, and escalate their own account to super_admin.
first public Nov 11, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Self-hosted Rote instances running version 2.6.0 or earlier. The flaw needs an authenticated admin account: that admin can read (or overwrite) the JWT signing secret through /v2/api/admin/settings, forge HS256 tokens for the super administrator and make their own account super_admin. Instances where only the owner is admin, or where no one untrusted has admin rights, can treat this as low urgency.
Not affected if fixed-commit-applied, fixed-version, no-admin-users-untrusted, single-trusted-admin
Who cares jwt, privilege-escalation, rote, self-hosted
v2.6.0 (12 Oct 2026), which is affectedRote through 2.6.0 contains a privilege escalation vulnerability that allows authenticated admins to obtain super_admin rights by reading or overwriting JWT signing secrets via /v2/api/admin/settings. Attackers can retrieve the unmasked jwtSecret from the security settings group and forge HS256 tokens for the super administrator to change user roles and escalate their own account.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
v2.6.0