{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/rote/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:rote:rote:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-126803"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Rote (\u003c= 2.6.0)"],"_cs_severities":["high"],"_cs_tags":["cve-2026-126803","privilege-escalation","web-application-vulnerability"],"_cs_type":"advisory","_cs_vendors":["Rote"],"content_html":"\u003cp\u003eRote versions up to and including 2.6.0 contain a privilege escalation vulnerability in the administrative settings endpoint. An authenticated administrator can retrieve the unmasked \u003ccode\u003ejwtSecret\u003c/code\u003e or overwrite it by making requests to the \u003ccode\u003e/v2/api/admin/settings\u003c/code\u003e endpoint. This allows an attacker to obtain the signing key, forge HS256 JWT tokens for super administrator accounts, and subsequently escalate privileges to modify user roles across the platform.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an authenticated administrator to escalate their privileges to a super administrator role. This grants the attacker full control over user roles and administrative configurations within the Rote platform.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate Rote to a patched version beyond 2.6.0 immediately to remediate CVE-2026-126803.\u003c/li\u003e\n\u003cli\u003eAudit logs for administrative access to the \u003ccode\u003e/v2/api/admin/settings\u003c/code\u003e endpoint for anomalous patterns or unauthorized changes.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-11T22:08:43Z","date_published":"2026-11-11T22:08:43Z","id":"https://feed.craftedsignal.io/briefs/2026-11-rote-privilege-escalation-cve-2026-126803/","summary":"Rote versions up to 2.6.0 contain a privilege escalation vulnerability that allows an authenticated administrator to forge JWT tokens by accessing the application's signing secret via the settings API.","title":"Rote: Privilege Escalation via JWT Secret Exposure (CVE-2026-126803)","url":"https://feed.craftedsignal.io/briefs/2026-11-rote-privilege-escalation-cve-2026-126803/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:rote:rote:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-126801"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Rote (1.2.0 through 2.6.0)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Rote"],"content_html":"\u003cp\u003eRote versions 1.2.0 through 2.6.0 contain an authorization bypass vulnerability in the OAuth bind/merge endpoint (CVE-2026-126801). The vulnerability allows an authenticated attacker to merge any OAuth-bound account into their own by submitting a public 'existingUserId' along with a target GitHub or Apple user ID. Successful exploitation grants the attacker full access to the victim's notes, attachments, and API keys, and permits the deletion of the victim's account.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in full account takeover, unauthorized access to sensitive user data, and the potential for account destruction. The CVSS 3.1 base score is 8.8.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eUpdate Rote instances to a version later than 2.6.0. Organizations should audit OAuth integration logs for anomalous merge activity or unexpected 'existingUserId' values in bind requests until the patch is applied.\u003c/p\u003e\n","date_modified":"2026-11-11T22:08:28Z","date_published":"2026-11-11T22:08:28Z","id":"https://feed.craftedsignal.io/briefs/2026-11-rote-auth-bypass-cve-2026-126801/","summary":"Rote versions 1.2.0 through 2.6.0 are vulnerable to an authorization bypass in the OAuth bind/merge endpoint that allows authenticated attackers to hijack, manipulate, and delete arbitrary user accounts.","title":"Rote: Authorization bypass in OAuth bind/merge endpoint (CVE-2026-126801)","url":"https://feed.craftedsignal.io/briefs/2026-11-rote-auth-bypass-cve-2026-126801/"}],"language":"en","title":"CraftedSignal Threat Feed - Rote","version":"https://jsonfeed.org/version/1.1"}