Live › vulnerability › CVE-2026-121454
Padloc's SCIM server accepts any non-empty bearer token, so an unauthenticated attacker can query the Users and Groups endpoints. Knowing an organization id is enough to retrieve usernames, emails, names, externalIds and group memberships.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 16:21 UTC. All times on this page are UTC.
Organizations running Padloc with the SCIM provisioning endpoint exposed are affected, since the flaw is in the SCIM server's authentication check. The sources do not say whether the default configuration enables SCIM. Teams using Padloc only through a managed service or without SCIM can likely skip it, but the sources do not confirm this.
No product ranges from the sources yet.
4.3.0Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Padloc through 4.3.0 contains a missing authentication vulnerability in ScimServer._handleScimGet() that allows unauthenticated attackers to read SCIM directories by sending any non-empty bearer token. Attackers who know an organization id can query the Users and Groups SCIM endpoints to retrieve provisioned usernames, emails, names, externalIds, and group memberships.
This page as .md · .json · in your agent: get_signal("CVE-2026-121454")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.