{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-126803/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:rote:rote:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-126803"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Rote (\u003c= 2.6.0)"],"_cs_severities":["high"],"_cs_tags":["cve-2026-126803","privilege-escalation","web-application-vulnerability"],"_cs_type":"advisory","_cs_vendors":["Rote"],"content_html":"\u003cp\u003eRote versions up to and including 2.6.0 contain a privilege escalation vulnerability in the administrative settings endpoint. An authenticated administrator can retrieve the unmasked \u003ccode\u003ejwtSecret\u003c/code\u003e or overwrite it by making requests to the \u003ccode\u003e/v2/api/admin/settings\u003c/code\u003e endpoint. This allows an attacker to obtain the signing key, forge HS256 JWT tokens for super administrator accounts, and subsequently escalate privileges to modify user roles across the platform.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an authenticated administrator to escalate their privileges to a super administrator role. This grants the attacker full control over user roles and administrative configurations within the Rote platform.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate Rote to a patched version beyond 2.6.0 immediately to remediate CVE-2026-126803.\u003c/li\u003e\n\u003cli\u003eAudit logs for administrative access to the \u003ccode\u003e/v2/api/admin/settings\u003c/code\u003e endpoint for anomalous patterns or unauthorized changes.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-11T22:08:43Z","date_published":"2026-11-11T22:08:43Z","id":"https://feed.craftedsignal.io/briefs/2026-11-rote-privilege-escalation-cve-2026-126803/","summary":"Rote versions up to 2.6.0 contain a privilege escalation vulnerability that allows an authenticated administrator to forge JWT tokens by accessing the application's signing secret via the settings API.","title":"Rote: Privilege Escalation via JWT Secret Exposure (CVE-2026-126803)","url":"https://feed.craftedsignal.io/briefs/2026-11-rote-privilege-escalation-cve-2026-126803/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-126803","version":"https://jsonfeed.org/version/1.1"}