Threats affecting pkg:github/Rote

Rote versions up to 2.6.0 have a privilege escalation vulnerability allowing authenticated admin users to gain super_admin rights by accessing or modifying JWT signing secrets via the /v2/api/admin/settings endpoint. This enables attackers to forge HS256 tokens for the super administrator, change user roles, and escalate privileges.

Rote versions 1.2.0 through 2.6.0 have an authorization bypass vulnerability in the OAuth bind/merge endpoint. This flaw allows authenticated users to merge any OAuth-bound account into their own by submitting a public existingUserId along with a GitHub or Apple user ID. Successful exploitation enables attackers to take over notes, attachments, API keys, and delete the victim's account.