CVE-2026-121454

EUVD-2026-115886
Padloc through 4.3.0 contains a missing authentication vulnerability in ScimServer._handleScimGet() that allows unauthenticated attackers to read SCIM directories by sending any non-empty bearer token. Attackers who know an organization id can query the Users and Groups SCIM endpoints to retrieve provisioned usernames, emails, names, externalIds, and group memberships.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
3.7 LOW
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/padloc/padloc
https://github.com/padloc/padloc/blob/v4.3.0/packages/server/src/scim.ts#L702-L714
https://github.com/padloc/padloc/commit/90dda7c6f417b28bee86ec60eff532eb18870125
https://github.com/padloc/padloc/issues/795
https://www.vulncheck.com/advisories/padloc-through-4.3.0-missing-scim-token-validation-via-scim-get-requests