PT-2026-145460
CVE-2026-126803
·
تاريخ النشر
2026-11-11
·
تاريخ التحديث
2026-11-11
الوصف من
CVSS 3.1
7.2
عاليةالمقاييسAV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Rote through 2.6.0 contains a privilege escalation vulnerability that allows authenticated admins to obtain super admin rights by reading or overwriting JWT signing secrets via /v2/api/admin/settings. Attackers can retrieve the unmasked jwtSecret from the security settings group and forge HS256 tokens for the super administrator to change user roles and escalate their own account.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾