CVE-2026-126803
Last modified
CVE-2026-126803 is a high-severity vulnerability rated 7.2/10 on the CVSS scale. Rote through 2.6.0 contains a privilege escalation vulnerability that allows authenticated admins to obtain super_admin rights by reading or overwriting JWT signing secrets via /v2/api/admin/settings. Attackers can retrieve the unmasked jwtSecret from the security settings group and forge HS256 tokens for the super administrator to change user roles and escalate their own account.. EPSS estimates a 0.42% chance of exploitation in the next 30 days.
Description
Rote through 2.6.0 contains a privilege escalation vulnerability that allows authenticated admins to obtain super_admin rights by reading or overwriting JWT signing secrets via /v2/api/admin/settings. Attackers can retrieve the unmasked jwtSecret from the security settings group and forge HS256 tokens for the super administrator to change user roles and escalate their own account.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Rabithua | Rote | <= 2.6.0 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-126803?
How severe is CVE-2026-126803?
How do I fix CVE-2026-126803?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-126798NextScan 1.1.0 through 1.2.0 contains a stored cross-site sc…4.7
- CVE-2026-126799Gotenberg 8.31.0 before 8.38.0 contains a server-side reques…7.5
- CVE-2026-1268The Dynamic Widget Content plugin for WordPress is vulnerabl…6.4
- CVE-2026-126800Hydro @hydrooj/ui-default before 4.59.1 contains a stored cr…8.7
- CVE-2026-126801Rote 1.2.0 through 2.6.0 contains an authorization bypass in…8.8
- CVE-2026-126802NextScan 1.1.0 through 1.2.0 contains hardcoded HTTP Basic A…8.2
- CVE-2026-126804WWBN AVideo 12.4 through 29.7.1 contains a path traversal vu…8.1
- CVE-2026-126805WWBN AVideo through 29.7.1 contains an incorrect authorizati…7.2
- CVE-2026-126806WWBN AVideo 14.3 through 29.7.1 contains a stored cross-site…8.7
- CVE-2026-126807WuzAPI through 1.1.0 contains a cross-tenant information dis…4.3
- CVE-2026-126808weDevs ERP (WP ERP) through 1.17.11 contains an incorrect au…4.3
- CVE-2026-126809WWBN AVideo through 29.7.1 contains a missing authorization …7.1
Are you affected by CVE-2026-126803?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST