CVE-2026-121454 Details
Description
Padloc through 4.3.0 contains a missing authentication vulnerability in ScimServer._handleScimGet() that allows unauthenticated attackers to read SCIM directories by sending any non-empty bearer token. Attackers who know an organization id can query the Users and Groups SCIM endpoints to retrieve provisioned usernames, emails, names, externalIds, and group memberships.
A missing authentication vulnerability has been identified in Padloc versions through 4.3.0, specifically within the SCIM server's GET request handler. This vulnerability allows unauthenticated attackers to access SCIM directories by sending any non-empty bearer token. Attackers with knowledge of a valid organization ID can exploit this to query the Users and Groups SCIM endpoints, retrieving provisioned usernames, emails, names, external IDs, and group memberships.
Users can update to Padloc version 4.3.1 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 3, 2026CISA-ADP
Assessed Nov 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/padloc/padloc/issues/795 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/padloc/padloc | [email protected] | Vendor |
| https://github.com/padloc/padloc/blob/v4.3.0/packages/server/src/scim.ts#L702-L714 | [email protected] | Source CodeVendor |
| https://github.com/padloc/padloc/commit/90dda7c6f417b28bee86ec60eff532eb18870125 | [email protected] | Source CodeVendor |
| https://github.com/padloc/padloc/issues/795 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/padloc-through-4.3.0-missing-scim-token-validation-via-scim-get-requests | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Padloc | <= 4.3.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 7, 2026 | CVE Modified | CISA-ADP |
| Nov 3, 2026 | New CVE Received | [email protected] |