Vulnerability · Published Nov 3, 2026 · Assigned by VulnCheck
CVE-2026-121454Padloc through 4.3.0 Missing SCIM Token Validation via SCIM GET Requests
Low 3.7
In plain English
A low-severity missing authentication in padloc from padloc. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).
Severity (CVSS 3.1)3.7Low
Exploit odds (30 days)0.3%top 72.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Padloc through 4.3.0 contains a missing authentication vulnerability in ScimServer._handleScimGet() that allows unauthenticated attackers to read SCIM directories by sending any non-empty bearer token. Attackers who know an organization id can query the Users and Groups SCIM endpoints to retrieve provisioned usernames, emails, names, externalIds, and group memberships.
Affected products (as reported)
Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
References
- GitHub Issue #795 issue-tracking
- https://github.com/padloc/padloc product
- Fix commit patch
- https://github.com/padloc/padloc/blob/v4.3.0/packages/server/src/scim.ts#L702-L714 technical-description
- VulnCheck Advisory: Padloc through 4.3.0 Missing SCIM Token Validation via SCIM GET Requests third-party-advisory