CVE-2026-126570

HIGH 7.6

Padloc 4.0.0 before 4.3.1 Prototype Pollution via SCIM PATCH setPath()

CVSS Score

7.6

EPSS Score

0.0%

EPSS Percentile

0th

Padloc 4.0.0 before 4.3.1 contains a prototype pollution vulnerability that allows SCIM token holders to modify Object.prototype by sending crafted SCIM PATCH paths to ScimServer._handleScimUsersPatch(). Attackers can supply paths like __proto__.x or constructor.prototype.x passed to setPath() to pollute the shared server process, disrupting requests for all other organizations.

CWE	CWE-1321
Vendor	padloc
Product	padloc
Published	Nov 11, 2026

Stay Ahead of the Next One

Get instant alerts for padloc padloc

Be the first to know when new high vulnerabilities affecting padloc padloc are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

Low

Availability

High

Affected Versions

padloc / padloc

4.0.0 < 4.3.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/padloc/padloc/security/advisories/GHSA-crhv-mjrg-8vwm github.com: https://github.com/padloc/padloc/commit/7dd3d230ef299c71ac215c802600b5f2358f7ba3 github.com: https://github.com/padloc/padloc/blob/v4.3.0/packages/server/src/scim.ts#L421-L428 github.com: https://github.com/padloc/padloc/blob/v4.3.0/packages/core/src/util.ts#L239-L251 vulncheck.com: https://www.vulncheck.com/advisories/padloc-4.0.0-before-4.3.1-prototype-pollution-via-scim-patch-setpath

Credits

Zachariah Mithani (AploSec)