CVE-2026-126803

The software Rote through 2.6.0 is vulnerable to a privilege escalation vulnerability. Authenticated admins can obtain super_admin rights by accessing the /v2/api/admin/settings endpoint, which allows for the reading or overwriting of JWT signing secrets . Specifically, attackers can retrieve the...

EUVD-2026-124018

Rote through 2.6.0 contains a privilege escalation vulnerability that allows authenticated admins to obtain superadmin rights by reading or overwriting JWT signing secrets via /v2/api/admin/settings. Attackers can retrieve the unmasked jwtSecret from the security settings group and forge HS256...

CVE-2026-126801

Rote versions 1.2.0 through 2.6.0 are vulnerable to an authorization bypass in the OAuth bind/merge endpoint. This flaw allows authenticated users to merge any OAuth-bound account into their own by submitting a public existingUserId and a GitHub or Apple user ID . Successful exploitation results ...

EUVD-2026-124016

Rote 1.2.0 through 2.6.0 contains an authorization bypass in the OAuth bind/merge endpoint that allows authenticated users to merge any OAuth-bound account into their own. Attackers can submit a public existingUserId and GitHub or Apple user ID to take over notes, attachments, and API keys and...

rote-pumpe.de Improper Access Control vulnerability OBB-3769430

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

rote-liste-zentrum.de Cross Site Scripting vulnerability OBB-3199824

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...