{"id":"CVE-2026-121454","kind":"vulnerability","aliases":["CVE-2026-121454"],"related":[],"title":"Padloc: SCIM endpoint leaks user and group directory to unauthenticated callers","description":"Padloc through 4.3.0 contains a missing authentication vulnerability in ScimServer._handleScimGet() that allows unauthenticated attackers to read SCIM directories by sending any non-empty bearer token. Attackers who know an organization id can query the Users and Groups SCIM endpoints to retrieve provisioned usernames, emails, names, externalIds, and group memberships.","summary":"Padloc's SCIM server accepts any non-empty bearer token, so an unauthenticated attacker can query the Users and Groups endpoints. Knowing an organization id is enough to retrieve usernames, emails, names, externalIds and group memberships.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other","padloc","scim","self-hosted"],"not_affected_if":["scim-disabled"],"how_to_check":"- Check whether the self-hosted Padloc server is running a version at or below `4.3.0`\n- Check whether SCIM provisioning is enabled for your Padloc organization","fix":"- Padloc: unknown (the sources reference a patch on github.com but do not state the fixed version)","status":"open","published_at":"2026-11-03T16:17:24+00:00","first_seen_at":"2026-11-03T16:21:43+00:00","triaged_at":"2026-11-03T16:24:10+00:00","updated_at":"2026-11-03T16:24:10+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-03T16:24:10Z","model":"claude-haiku-5-5","output":{"fix":"- Padloc: unknown (the sources reference a patch on github.com but do not state the fixed version)","reach":"internet","title":"Padloc: SCIM endpoint leaks user and group directory to unauthenticated callers","impact":"medium","summary":"Padloc's SCIM server accepts any non-empty bearer token, so an unauthenticated attacker can query the Users and Groups endpoints. Knowing an organization id is enough to retrieve usernames, emails, names, externalIds and group memberships.","audience":"businesses","category":"other","nicknames":[],"who_cares":["padloc","scim","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker reads employee names, emails and group memberships from directory","analyst_note":"Confirm the fixed Padloc version from the github.com patch link and whether SCIM is enabled by default.","how_to_check":"- Check whether the self-hosted Padloc server is running a version at or below `4.3.0`\n- Check whether SCIM provisioning is enabled for your Padloc organization\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["scim-disabled"],"who_is_affected":"Organizations running Padloc with the SCIM provisioning endpoint exposed are affected, since the flaw is in the SCIM server's authentication check. The sources do not say whether the default configuration enables SCIM. Teams using Padloc only through a managed service or without SCIM can likely skip it, but the sources do not confirm this.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000706,"input_tokens":4193,"output_tokens":573,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-121454':14A,17A '-2026':13A,16A '4.3.0':63C 'accept':28B 'allow':72C 'attack':38B,74C,87C 'authent':67C 'bearer':33B,85C 'caller':11A 'contain':64C 'cve':12A,15A 'directori':8A,78C 'email':55B,105C 'empti':32B,84C 'endpoint':3A,45B,100C 'enough':51B 'externalid':57B,107C 'group':7A,44B,59B,98C,109C 'host':23B 'id':49B,92C 'know':46B,89C 'leak':4A 'membership':60B,110C 'miss':66C 'name':56B,106C 'non':31B,83C 'non-empti':30B,82C 'organ':48B,91C 'padloc':1A,19B,24B,61C 'provis':103C 'queri':40B,94C 'read':76C 'retriev':53B,102C 'scim':2A,20B,26B,77C,99C 'scimserver._handlescimget':70C 'self':22B 'self-host':21B 'send':80C 'server':27B 'token':34B,86C 'unauthent':10A,37B,73C 'user':5A,42B,96C 'usernam':54B,104C 'vulner':68C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Padloc with the SCIM provisioning endpoint exposed are affected, since the flaw is in the SCIM server's authentication check. The sources do not say whether the default configuration enables SCIM. Teams using Padloc only through a managed service or without SCIM can likely skip it, but the sources do not confirm this.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","other","padloc","scim","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-03T16:17:24+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121454","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121454","severity":null,"published_at":"2026-11-03T16:17:24+00:00","modified_at":"2026-11-03T16:17:24+00:00","first_seen_at":"2026-11-03T16:21:43+00:00","fetched_at":"2026-11-03T16:21:43+00:00","note":null}],"documents":[{"id":58817,"url":"https://github.com/padloc/padloc/commit/90dda7c6f417b28bee86ec60eff532eb18870125","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":58818,"url":"https://www.vulncheck.com/advisories/padloc-through-4.3.0-missing-scim-token-validation-via-scim-get-requests","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}