Description
Rote through 2.6.0 contains a privilege escalation vulnerability that allows authenticated admins to obtain super_admin rights by reading or overwriting JWT signing secrets via /v2/api/admin/settings. Attackers can retrieve the unmasked jwtSecret from the security settings group and forge HS256 tokens for the super administrator to change user roles and escalate their own account.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Rabithua | Rote | ≤ 2.6.0 | — |
References
- https://github.com/Rabithua/Rote/pull/420 issue-tracking patch
- https://github.com/Rabithua/Rote/commit/865d69fceb9c1f1a0d30923fae7cef072a38b22b patch
- https://github.com/Rabithua/Rote/blob/v2.6.0/server/route/v2/admin.ts#L86-L146 technical-description
- https://vul.yulun.ac.cn/20261104/rote/ third-party-advisory
- VulnCheck Advisory: Rote through 2.6.0 Privilege Escalation via Admin Settings API JWT Secret Exposure third-party-advisory