CVE-2026-126803: Rote through 2.6.0 Privilege Escalation via Admin Settings API JWT Secret Exposure

Rote through 2.6.0 contains a privilege escalation vulnerability that allows authenticated admins to obtain superadmin rights by reading or overwriting JWT signing secrets via /v2/api/admin/settings. Attackers can retrieve the unmasked jwtSecret from the security settings group and forge HS256 tokens for the super administrator to change user roles and escalate their own account.