---
id: "CVE-2026-126803"
page: "https://infrastack.ai/live/CVE-2026-126803"
kind: "vulnerability"
aliases: ["CVE-2026-126803"]
title: "Rote: admins can steal JWT secret and forge super_admin tokens"
severity: "high"
cvss: 8.6
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Rote", "fixed": [], "affected": "<= 2.6.0", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["jwt", "other", "privilege-escalation", "rote", "self-hosted"]
not_affected_if: ["fixed-commit-applied", "fixed-version", "no-admin-users-untrusted", "single-trusted-admin"]
published_at: "2026-11-11T21:16:44+00:00"
first_seen_at: "2026-11-11T21:29:08+00:00"
updated_at: "2026-11-11T21:31:42+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126803", "first_seen_at": "2026-11-11T21:29:08+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-11T21:31:42+00:00"}]
exploit_sources: []
---

# Rote: admins can steal JWT secret and forge super_admin tokens

Link for people: https://infrastack.ai/live/CVE-2026-126803 (this .md is for agents)

Rote through version 2.6.0 exposes the unmasked JWT signing secret through its admin settings API. An authenticated admin can read or overwrite that secret, forge HS256 tokens for the super administrator, and escalate their own account to super_admin.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Rote affected <= 2.6.0 fixed no fixed version listed

## How to check

- Check the running version: Rote <= 2.6.0 is affected (site API field system.releaseVersion shows the backend version).
- As an admin, call GET /v2/api/admin/settings and look in the security group for a plaintext jwtSecret; the fixed code masks signing keys.
- If untrusted people hold admin accounts, review the user list for unexpected super_admin roles.

## Fix

No tagged release containing the fix was found: the newest release on github.com/Rabithua/Rote/releases is v2.6.0 (12 Oct 2026), which is affected. The fix is commit 865d69f (PR #420, merged 2026-10-31). Until a release after v2.6.0 ships, build from main at or after that commit, then rotate the JWT secret.

## Timeline

- 2026-11-11T21:29:08+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126803
- 2026-11-11T21:31:42+00:00 analyst — Fix is maintainer commit 865d69f (PR #420, 2026-10-31, 'protect signing keys across all admin settings reads and writes'); the releases page lists v2.6.0 (12 Oct) as newest, so no tagged fixed release seen yet. Vulncheck advisory confirms <= 2.6.0, admin-only (PR:H), no exploitation or PoC found.

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/rote-through-2.6.0-privilege-escalation-via-admin-settings-api-jwt-secret-exposure
- [fix] Patch: github.com https://github.com/Rabithua/Rote/commit/865d69fceb9c1f1a0d30923fae7cef072a38b22b

## From the sources

Rote through 2.6.0 contains a privilege escalation vulnerability that allows authenticated admins to obtain super_admin rights by reading or overwriting JWT signing secrets via /v2/api/admin/settings. Attackers can retrieve the unmasked jwtSecret from the security settings group and forge HS256 tokens for the super administrator to change user roles and escalate their own account.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_