Privilege Escalation Vulnerability in Rote by Rabithua

CVE-2026-126803

What is CVE-2026-126803?

The Rote application version 2.6.0 has a vulnerability that allows authenticated administrators to escalate their privileges to super_admin level. Through the /v2/api/admin/settings endpoint, attackers can access or modify JWT signing secrets, enabling them to retrieve the unmasked jwtSecret from the security settings group. This exposure allows exploitation, where malicious actors can forge HS256 tokens that alter user roles and promote their own accounts to super administrator status.

References