{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/rote-1.2.0-through-2.6.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:rote:rote:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-126801"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Rote (1.2.0 through 2.6.0)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Rote"],"content_html":"\u003cp\u003eRote versions 1.2.0 through 2.6.0 contain an authorization bypass vulnerability in the OAuth bind/merge endpoint (CVE-2026-126801). The vulnerability allows an authenticated attacker to merge any OAuth-bound account into their own by submitting a public 'existingUserId' along with a target GitHub or Apple user ID. Successful exploitation grants the attacker full access to the victim's notes, attachments, and API keys, and permits the deletion of the victim's account.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in full account takeover, unauthorized access to sensitive user data, and the potential for account destruction. The CVSS 3.1 base score is 8.8.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eUpdate Rote instances to a version later than 2.6.0. Organizations should audit OAuth integration logs for anomalous merge activity or unexpected 'existingUserId' values in bind requests until the patch is applied.\u003c/p\u003e\n","date_modified":"2026-11-11T22:08:28Z","date_published":"2026-11-11T22:08:28Z","id":"https://feed.craftedsignal.io/briefs/2026-11-rote-auth-bypass-cve-2026-126801/","summary":"Rote versions 1.2.0 through 2.6.0 are vulnerable to an authorization bypass in the OAuth bind/merge endpoint that allows authenticated attackers to hijack, manipulate, and delete arbitrary user accounts.","title":"Rote: Authorization bypass in OAuth bind/merge endpoint (CVE-2026-126801)","url":"https://feed.craftedsignal.io/briefs/2026-11-rote-auth-bypass-cve-2026-126801/"}],"language":"en","title":"CraftedSignal Threat Feed - Rote (1.2.0 Through 2.6.0)","version":"https://jsonfeed.org/version/1.1"}