CVE-2026-121454

LOW 3.7

Padloc through 4.3.0 Missing SCIM Token Validation via SCIM GET Requests

CVSS Score

3.7

EPSS Score

0.0%

EPSS Percentile

0th

Padloc through 4.3.0 contains a missing authentication vulnerability in ScimServer._handleScimGet() that allows unauthenticated attackers to read SCIM directories by sending any non-empty bearer token. Attackers who know an organization id can query the Users and Groups SCIM endpoints to retrieve provisioned usernames, emails, names, externalIds, and group memberships.

CWE	CWE-306
Vendor	padloc
Product	padloc
Published	Nov 3, 2026

Stay Ahead of the Next One

Get instant alerts for padloc padloc

Be the first to know when new low vulnerabilities affecting padloc padloc are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Affected Versions

padloc / padloc

0 ≤ 4.3.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/padloc/padloc/issues/795 github.com: https://github.com/padloc/padloc github.com: https://github.com/padloc/padloc/commit/90dda7c6f417b28bee86ec60eff532eb18870125 github.com: https://github.com/padloc/padloc/blob/v4.3.0/packages/server/src/scim.ts#L702-L714 vulncheck.com: https://www.vulncheck.com/advisories/padloc-through-4.3.0-missing-scim-token-validation-via-scim-get-requests

Credits

George Chen