Rote (<= 2.6.0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/rote--2.6.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 11 Nov 2026 22:08:43 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgRote: Privilege Escalation via JWT Secret Exposure (CVE-2026-126803)https://feed.craftedsignal.io/briefs/2026-11-rote-privilege-escalation-cve-2026-126803/Wed, 11 Nov 2026 22:08:43 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-rote-privilege-escalation-cve-2026-126803/Rote versions up to 2.6.0 contain a privilege escalation vulnerability that allows an authenticated administrator to forge JWT tokens by accessing the application's signing secret via the settings API.Rote versions up to and including 2.6.0 contain a privilege escalation vulnerability in the administrative settings endpoint. An authenticated administrator can retrieve the unmasked jwtSecret or overwrite it by making requests to the /v2/api/admin/settings endpoint. This allows an attacker to obtain the signing key, forge HS256 JWT tokens for super administrator accounts, and subsequently escalate privileges to modify user roles across the platform.

Impact

Successful exploitation allows an authenticated administrator to escalate their privileges to a super administrator role. This grants the attacker full control over user roles and administrative configurations within the Rote platform.

Recommendation

  • Update Rote to a patched version beyond 2.6.0 immediately to remediate CVE-2026-126803.
  • Audit logs for administrative access to the /v2/api/admin/settings endpoint for anomalous patterns or unauthorized changes.
]]>highadvisorycve-2026-126803privilege-escalationweb-application-vulnerability