{"id":"CVE-2026-121454","title":"Padloc through 4.3.0 Missing SCIM Token Validation via SCIM GET Requests","summary":"Padloc through 4.3.0 contains a missing authentication vulnerability in ScimServer._handleScimGet() that allows unauthenticated attackers to read SCIM directories by sending any non-empty bearer token. Attackers who know an organization …","severity":"low","cvss":3.7,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","cvssSource":"cna","cwe":["CWE-306"],"vendor":"padloc","product":"padloc","affected":["padloc <= 4.3.0"],"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-07T03:05:53.763165Z"},"exploitAvailable":true,"published":"2026-11-03","updated":"2026-11-07","sourceUpdated":"2026-11-07T03:06:24.553Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-121454","references":[{"url":"https://github.com/padloc/padloc/issues/795","label":"GitHub Issue #795"},{"url":"https://github.com/padloc/padloc"},{"url":"https://github.com/padloc/padloc/commit/90dda7c6f417b28bee86ec60eff532eb18870125","label":"Fix commit"},{"url":"https://github.com/padloc/padloc/blob/v4.3.0/packages/server/src/scim.ts#L702-L714"},{"url":"https://www.vulncheck.com/advisories/padloc-through-4.3.0-missing-scim-token-validation-via-scim-get-requests","label":"VulnCheck Advisory: Padloc through 4.3.0 Missing SCIM Token Validation via SCIM GET Requests"}],"tags":["cve.org","exploit-available"],"epss":0.00341,"epssPercentile":0.27798,"ingestedAt":"2026-11-05T19:30:42.974Z","slug":"CVE-2026-121454","body":"## Overview\n\nPadloc through 4.3.0 contains a missing authentication vulnerability in ScimServer._handleScimGet() that allows unauthenticated attackers to read SCIM directories by sending any non-empty bearer token. Attackers who know an organization id can query the Users and Groups SCIM endpoints to retrieve provisioned usernames, emails, names, externalIds, and group memberships.\n\n## Affected\n\n- `padloc <= 4.3.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":32,"depthScoreParts":{"impact":20.4,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":235766,"id":"CVE-2026-121454","ts":1794024606989,"field":"exploit_available","old":"false","new":"true"}]}