Skip to content
Privilege Escalation Vulnerability in Rote 2.6.0 Exposed

Privilege Escalation Vulnerability in Rote 2.6.0 Exposed

First seen 12 Nov 2026, 16:49 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 12, 2026 at 16:50 UTC
  • •CVE-2026-126803 allows privilege escalation via JWT secret exposure.
  • •Affected systems include Rote version 2.6.0 with admin API access.
  • •Organizations should upgrade and restrict access to mitigate risks.

A privilege escalation vulnerability, CVE-2026-126803, has been identified in Rote version 2.6.0, allowing authenticated administrators to gain super_admin rights by accessing JWT signing secrets through the admin settings API. This flaw enables attackers with admin access to forge HS256 tokens, potentially leading to unauthorized data access and service disruption. The vulnerability is classified as high severity with a CVSS score of 8.6. Organizations using self-hosted deployments, especially those with exposed admin interfaces, are at significant risk. As of now, there is no indication of active exploitation, but the urgency for remediation is emphasized. Users are advised to upgrade to a patched version and restrict admin API access to trusted networks.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 3h ago How this analysis works

Timeline

2026-11-11
CVE-2026-126803 published
The vulnerability was published with a CVSS score of 8.6, indicating high severity.
www.vulncheck.com

More articles in this cluster (5)

Following this threat?

Track CVE-2026-126803 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (5)

1 / 4

Common questions

What versions are affected?
Rote version 2.6.0 is affected by CVE-2026-126803.
Is there any active exploitation reported?
No active exploitation has been confirmed for this vulnerability.
What should organizations do to protect themselves?
Organizations should upgrade to the latest version of Rote and restrict access to the admin API.