Threats tagged 'ghsa-8927-rvwm-j8p3'

Rote through version 2.6.0 has a privilege escalation vulnerability that enables authenticated administrators to gain super_admin rights. This is achieved by accessing or modifying JWT signing secrets through the /v2/api/admin/settings endpoint. Exploiting this flaw allows attackers to retrieve the unmasked jwtSecret and forge HS256 tokens for the super administrator, enabling them to change user roles and escalate privileges.