Authorization Bypass Vulnerability in Rote by Rabithua

CVE-2026-126801

What is CVE-2026-126801?

Versions 1.2.0 through 2.6.0 of the Rote application are susceptible to an authorization bypass flaw within the OAuth bind/merge endpoint. This vulnerability allows authenticated users to merge any existing OAuth-bound account into their own account. By leveraging this weakness, attackers can exploit public existingUserId along with a GitHub or Apple user ID, leading to unauthorized access. Consequently, they may gain control over sensitive data such as notes, attachments, and API keys, and they can also delete the victim's account. This highlights the critical need for users to update to patched versions promptly.

References