{"id":"CVE-2026-126801","kind":"vulnerability","aliases":["CVE-2026-126801"],"related":[],"title":"Rote: authorization bypass lets users take over other accounts","description":"Rote 1.2.0 through 2.6.0 contains an authorization bypass in the OAuth bind/merge endpoint that allows authenticated users to merge any OAuth-bound account into their own. Attackers can submit a public existingUserId and GitHub or Apple user ID to take over notes, attachments, and API keys and delete the victim account.","summary":"Rote versions 1.2.0 through 2.6.0 have an authorization bypass in the OAuth bind/merge endpoint. An authenticated user can merge any OAuth-linked account into their own, gaining its notes, attachments and API keys and deleting the victim account.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Rote","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["oauth","other","rote","self-hosted"],"not_affected_if":["oauth-disabled","outside-version-range"],"how_to_check":"- Check the installed Rote version against the range `1.2.0` through `2.6.0`","fix":"- Move to a version after `2.6.0`; the exact fixed version is unknown from the sources\n- A patch is linked from the advisory sources","status":"open","published_at":"2026-11-11T21:16:43+00:00","first_seen_at":"2026-11-11T21:29:08+00:00","triaged_at":"2026-11-11T21:30:36+00:00","updated_at":"2026-11-11T21:30:36+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-11T21:30:36Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a version after `2.6.0`; the exact fixed version is unknown from the sources\n- A patch is linked from the advisory sources","reach":"internet","title":"Rote: authorization bypass lets users take over other accounts","impact":"high","summary":"Rote versions 1.2.0 through 2.6.0 have an authorization bypass in the OAuth bind/merge endpoint. An authenticated user can merge any OAuth-linked account into their own, gaining its notes, attachments and API keys and deleting the victim account.","audience":"businesses","category":"other","nicknames":[],"who_cares":["rote","self-hosted","oauth"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"attacker takes over other users' notes, keys and deletes accounts","analyst_note":"Confirm the fixed version and the vendor patch at the linked github.com patch page, and check whether OAuth binding is enabled by default.","how_to_check":"- Check the installed Rote version against the range `1.2.0` through `2.6.0`\n- unknown","plain_action":"","product_name":"Rote","needs_analyst":true,"not_affected_if":["outside-version-range","oauth-disabled"],"who_is_affected":"Teams running self-hosted Rote instances in the affected range where users can sign in with OAuth (GitHub or Apple). The bind/merge endpoint is the attack path, so instances without OAuth binding are less exposed. unknown whether default configurations enable it.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000745,"input_tokens":4613,"output_tokens":568,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126801':12A,15A '-2026':11A,14A '1.2.0':25B,63C '2.6.0':27B,65C 'account':9A,46B,61B,85C,113C 'allow':76C 'api':55B,107C 'appl':98C 'attach':53B,105C 'attack':89C 'authent':38B,77C 'author':2A,30B,68C 'bind/merge':35B,73C 'bound':84C 'bypass':3A,31B,69C 'contain':66C 'cve':10A,13A 'delet':58B,110C 'endpoint':36B,74C 'existinguserid':94C 'gain':50B 'github':96C 'host':22B 'id':100C 'key':56B,108C 'let':4A 'link':45B 'merg':41B,80C 'note':52B,104C 'oauth':17B,34B,44B,72C,83C 'oauth-bound':82C 'oauth-link':43B 'public':93C 'rote':1A,16A,19B,23B,62C 'self':21B 'self-host':20B 'submit':91C 'take':6A,102C 'user':5A,39B,78C,99C 'version':24B 'victim':60B,112C","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted Rote instances in the affected range where users can sign in with OAuth (GitHub or Apple). The bind/merge endpoint is the attack path, so instances without OAuth binding are less exposed. unknown whether default configurations enable it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["rote"],"ptokens":["rote"],"labels":["high","oauth","other","rote","selfhosted","vendor"],"campaign_type":null,"search_a":"'-126801':12A,15A '-2026':11A,14A 'account':9A 'author':2A 'bypass':3A 'cve':10A,13A 'let':4A 'rote':1A,16A 'take':6A 'user':5A","search_b":"'1.2.0':25B '2.6.0':27B 'account':46B,61B 'api':55B 'attach':53B 'authent':38B 'author':30B 'bind/merge':35B 'bypass':31B 'delet':58B 'endpoint':36B 'gain':50B 'host':22B 'key':56B 'link':45B 'merg':41B 'note':52B 'oauth':17B,34B,44B 'oauth-link':43B 'rote':19B,23B 'self':21B 'self-host':20B 'user':39B 'version':24B 'victim':60B","search_c":"'1.2.0':63C '2.6.0':65C 'account':85C,113C 'allow':76C 'api':107C 'appl':98C 'attach':105C 'attack':89C 'authent':77C 'author':68C 'bind/merge':73C 'bound':84C 'bypass':69C 'contain':66C 'delet':110C 'endpoint':74C 'existinguserid':94C 'github':96C 'id':100C 'key':108C 'merg':80C 'note':104C 'oauth':72C,83C 'oauth-bound':82C 'public':93C 'rote':62C 'submit':91C 'take':102C 'user':78C,99C 'victim':112C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T21:16:43+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126801","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126801","severity":null,"published_at":"2026-11-11T21:16:43+00:00","modified_at":"2026-11-11T21:16:43+00:00","first_seen_at":"2026-11-11T21:29:08+00:00","fetched_at":"2026-11-11T21:29:08+00:00","note":null}],"documents":[{"id":128965,"url":"https://github.com/Rabithua/Rote/commit/865d69fceb9c1f1a0d30923fae7cef072a38b22b","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":128966,"url":"https://www.vulncheck.com/advisories/rote-1.2.0-through-2.6.0-account-takeover-via-oauth-account-merge-endpoint","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}