Product
Rote versions 1.2.0 through 2.6.0 are vulnerable to an authorization bypass in the OAuth bind/merge endpoint that allows authenticated attackers to hijack, manipulate, and delete arbitrary user accounts.