{"id":"CVE-2026-126803","kind":"vulnerability","aliases":["CVE-2026-126803"],"related":[],"title":"Rote: admins can steal JWT secret and forge super_admin tokens","description":"Rote through 2.6.0 contains a privilege escalation vulnerability that allows authenticated admins to obtain super_admin rights by reading or overwriting JWT signing secrets via /v2/api/admin/settings. Attackers can retrieve the unmasked jwtSecret from the security settings group and forge HS256 tokens for the super administrator to change user roles and escalate their own account.","summary":"Rote through version 2.6.0 exposes the unmasked JWT signing secret through its admin settings API. An authenticated admin can read or overwrite that secret, forge HS256 tokens for the super administrator, and escalate their own account to super_admin.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Rote","fixed":[],"affected":"<= 2.6.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["jwt","other","privilege-escalation","rote","self-hosted"],"not_affected_if":["fixed-commit-applied","fixed-version","no-admin-users-untrusted","single-trusted-admin"],"how_to_check":"- Check the running version: Rote <= 2.6.0 is affected (site API field system.releaseVersion shows the backend version).\n- As an admin, call GET /v2/api/admin/settings and look in the security group for a plaintext jwtSecret; the fixed code masks signing keys.\n- If untrusted people hold admin accounts, review the user list for unexpected super_admin roles.","fix":"No tagged release containing the fix was found: the newest release on github.com/Rabithua/Rote/releases is v2.6.0 (12 Oct 2026), which is affected. The fix is commit 865d69f (PR #420, merged 2026-10-31). Until a release after v2.6.0 ships, build from main at or after that commit, then rotate the JWT secret.","status":"open","published_at":"2026-11-11T21:16:44+00:00","first_seen_at":"2026-11-11T21:29:08+00:00","triaged_at":"2026-11-11T21:30:40+00:00","updated_at":"2026-11-11T21:31:42+00:00","category":"other","confidence":0.75,"triage":{"at":"2026-11-11T21:30:40Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Rote: admins can steal JWT secret and forge super_admin tokens","impact":"high","summary":"Rote through version 2.6.0 exposes the unmasked JWT signing secret through its admin settings API. An authenticated admin can read or overwrite that secret, forge HS256 tokens for the super administrator, and escalate their own account to super_admin.","audience":"businesses","category":"other","nicknames":[],"who_cares":["rote","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Admin escalates to super_admin and forges tokens for any account","analyst_note":"Find the fixed version from the github.com patch link and confirm the vulncheck advisory details.","how_to_check":"- Check whether the installed Rote version is `2.6.0` or earlier.\n- Look at the security settings group in the admin settings for an unmasked `jwtSecret` value.\n- unknown for any other check, as the sources do not say.","plain_action":"","product_name":"Rote","needs_analyst":true,"not_affected_if":["no-admin-users-untrusted","fixed-version"],"who_is_affected":"Rote deployments at version 2.6.0 or earlier are exposed, and the flaw needs an authenticated admin account. The sources reference a patch on github.com but do not state the fixed version, so the exact fix is unknown. Teams that restrict admin accounts to trusted people face less immediate risk.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000745,"input_tokens":4616,"output_tokens":566,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the fixed version from the github.com patch link and confirm the vulncheck advisory details.","search":"'-126803':14A,17A '-2026':13A,16A '/v2/api/admin/settings':92C '2.6.0':31B,69C 'account':63B,120C 'admin':2A,10A,40B,45B,66B,78C,82C 'administr':58B,111C 'allow':76C 'api':42B 'attack':93C 'authent':44B,77C 'chang':113C 'contain':70C 'cve':12A,15A 'escal':23B,60B,73C,117C 'expos':32B 'forg':8A,52B,105C 'group':103C 'host':27B 'hs256':53B,106C 'jwt':5A,19B,35B,88C 'jwtsecret':98C 'obtain':80C 'overwrit':49B,87C 'privileg':22B,72C 'privilege-escal':21B 'read':47B,85C 'retriev':95C 'right':83C 'role':115C 'rote':1A,18A,24B,28B,67C 'secret':6A,37B,51B,90C 'secur':101C 'self':26B 'self-host':25B 'set':41B,102C 'sign':36B,89C 'steal':4A 'super':9A,57B,65B,81C,110C 'token':11A,54B,107C 'unmask':34B,97C 'user':114C 'version':30B 'via':91C 'vulner':74C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Rote instances running version 2.6.0 or earlier. The flaw needs an authenticated admin account: that admin can read (or overwrite) the JWT signing secret through /v2/api/admin/settings, forge HS256 tokens for the super administrator and make their own account super_admin. Instances where only the owner is admin, or where no one untrusted has admin rights, can treat this as low urgency.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["rote"],"ptokens":["rote"],"labels":["high","jwt","other","privilegeescalation","rote","selfhosted","vendor"],"campaign_type":null,"search_a":"'-126803':14A,17A '-2026':13A,16A 'admin':2A,10A 'cve':12A,15A 'forg':8A 'jwt':5A 'rote':1A,18A 'secret':6A 'steal':4A 'super':9A 'token':11A","search_b":"'2.6.0':31B 'account':63B 'admin':40B,45B,66B 'administr':58B 'api':42B 'authent':44B 'escal':23B,60B 'expos':32B 'forg':52B 'host':27B 'hs256':53B 'jwt':19B,35B 'overwrit':49B 'privileg':22B 'privilege-escal':21B 'read':47B 'rote':24B,28B 'secret':37B,51B 'self':26B 'self-host':25B 'set':41B 'sign':36B 'super':57B,65B 'token':54B 'unmask':34B 'version':30B","search_c":"'/v2/api/admin/settings':92C '2.6.0':69C 'account':120C 'admin':78C,82C 'administr':111C 'allow':76C 'attack':93C 'authent':77C 'chang':113C 'contain':70C 'escal':73C,117C 'forg':105C 'group':103C 'hs256':106C 'jwt':88C 'jwtsecret':98C 'obtain':80C 'overwrit':87C 'privileg':72C 'read':85C 'retriev':95C 'right':83C 'role':115C 'rote':67C 'secret':90C 'secur':101C 'set':102C 'sign':89C 'super':81C,110C 'token':107C 'unmask':97C 'user':114C 'via':91C 'vulner':74C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T21:16:44+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126803","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126803","severity":null,"published_at":"2026-11-11T21:16:44+00:00","modified_at":"2026-11-11T21:16:44+00:00","first_seen_at":"2026-11-11T21:29:08+00:00","fetched_at":"2026-11-11T21:29:08+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126803:3599","url":null,"severity":null,"published_at":"2026-11-11T21:31:42+00:00","modified_at":"2026-11-11T21:31:42+00:00","first_seen_at":"2026-11-11T21:31:42+00:00","fetched_at":"2026-11-11T21:31:42+00:00","note":"Fix is maintainer commit 865d69f (PR #420, 2026-10-31, 'protect signing keys across all admin settings reads and writes'); the releases page lists v2.6.0 (12 Oct) as newest, so no tagged fixed release seen yet. Vulncheck advisory confirms <= 2.6.0, admin-only (PR:H), no exploitation or PoC found."}],"documents":[{"id":128965,"url":"https://github.com/Rabithua/Rote/commit/865d69fceb9c1f1a0d30923fae7cef072a38b22b","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":128969,"url":"https://www.vulncheck.com/advisories/rote-through-2.6.0-privilege-escalation-via-admin-settings-api-jwt-secret-exposure","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}