{"id":"CVE-2026-126570","kind":"vulnerability","aliases":["CVE-2026-126570"],"related":[],"title":"Padloc: SCIM token holders can pollute server-wide JavaScript object prototype","description":"Padloc 4.0.0 before 4.3.1 contains a prototype pollution vulnerability that allows SCIM token holders to modify Object.prototype by sending crafted SCIM PATCH paths to ScimServer._handleScimUsersPatch(). Attackers can supply paths like __proto__.x or constructor.prototype.x passed to setPath() to pollute the shared server process, disrupting requests for all other organizations.","summary":"Padloc 4.0.0 before 4.3.1 lets a holder of a SCIM token send crafted PATCH paths that modify Object.prototype in the shared server process. The polluted prototype disrupts requests for every other organization on that server.","severity":"high","cvss":7.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Padloc","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["other","padloc","scim","self-hosted"],"not_affected_if":["patched-4.3.1","scim-disabled"],"how_to_check":"- Check the Padloc server version; affected releases are `4.0.0` up to but not including `4.3.1`.\n- Check whether SCIM provisioning is enabled and whether any SCIM tokens have been issued.","fix":"- Padloc: move to `4.3.1` or later.","status":"open","published_at":"2026-11-11T03:16:51+00:00","first_seen_at":"2026-11-11T03:25:00+00:00","triaged_at":"2026-11-11T03:26:22+00:00","updated_at":"2026-11-11T03:26:22+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-11T03:26:22Z","model":"claude-haiku-5-5","output":{"fix":"- Padloc: move to `4.3.1` or later.","reach":"internet","title":"Padloc: SCIM token holders can pollute server-wide JavaScript object prototype","impact":"medium","summary":"Padloc 4.0.0 before 4.3.1 lets a holder of a SCIM token send crafted PATCH paths that modify Object.prototype in the shared server process. The polluted prototype disrupts requests for every other organization on that server.","audience":"businesses","category":"other","nicknames":[],"who_cares":["padloc","scim","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Server-wide prototype pollution disrupts requests for all organizations.","analyst_note":"","how_to_check":"- Check the Padloc server version; affected releases are `4.0.0` up to but not including `4.3.1`.\n- Check whether SCIM provisioning is enabled and whether any SCIM tokens have been issued.","plain_action":"","product_name":"Padloc","needs_analyst":false,"not_affected_if":["scim-disabled","patched-4.3.1"],"who_is_affected":"Self-hosted or hosted Padloc instances on versions 4.0.0 through 4.2.x that use SCIM provisioning are exposed. The flaw needs a valid SCIM token, so instances without SCIM enabled or without issued tokens are not exposed. Any organization on a shared server can be disrupted by a token holder from another organization.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.001181,"input_tokens":4657,"output_tokens":1431,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126570':15A,18A '-2026':14A,17A '4.0.0':27B,62C '4.3.1':29B,64C 'allow':71C 'attack':86C 'constructor.prototype':94C 'contain':65C 'craft':38B,80C 'cve':13A,16A 'disrupt':52B,105C 'everi':55B 'holder':4A,32B,74C 'host':25B 'javascript':10A 'let':30B 'like':90C 'modifi':42B,76C 'object':11A 'object.prototype':43B,77C 'organ':57B,110C 'padloc':1A,19A,21B,26B,61C 'pass':96C 'patch':39B,82C 'path':40B,83C,89C 'pollut':6A,50B,68C,100C 'process':48B,104C 'proto':91C 'prototyp':12A,51B,67C 'request':53B,106C 'scim':2A,22B,35B,72C,81C 'scimserver._handlescimuserspatch':85C 'self':24B 'self-host':23B 'send':37B,79C 'server':8A,47B,60B,103C 'server-wid':7A 'setpath':98C 'share':46B,102C 'suppli':88C 'token':3A,36B,73C 'vulner':69C 'wide':9A 'x':92C,95C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted or hosted Padloc instances on versions 4.0.0 through 4.2.x that use SCIM provisioning are exposed. The flaw needs a valid SCIM token, so instances without SCIM enabled or without issued tokens are not exposed. Any organization on a shared server can be disrupted by a token holder from another organization.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["padloc"],"ptokens":["padloc"],"labels":["high","other","padloc","scim","selfhosted","vendor"],"campaign_type":null,"search_a":"'-126570':15A,18A '-2026':14A,17A 'cve':13A,16A 'holder':4A 'javascript':10A 'object':11A 'padloc':1A,19A 'pollut':6A 'prototyp':12A 'scim':2A 'server':8A 'server-wid':7A 'token':3A 'wide':9A","search_b":"'4.0.0':27B '4.3.1':29B 'craft':38B 'disrupt':52B 'everi':55B 'holder':32B 'host':25B 'let':30B 'modifi':42B 'object.prototype':43B 'organ':57B 'padloc':21B,26B 'patch':39B 'path':40B 'pollut':50B 'process':48B 'prototyp':51B 'request':53B 'scim':22B,35B 'self':24B 'self-host':23B 'send':37B 'server':47B,60B 'share':46B 'token':36B","search_c":"'4.0.0':62C '4.3.1':64C 'allow':71C 'attack':86C 'constructor.prototype':94C 'contain':65C 'craft':80C 'disrupt':105C 'holder':74C 'like':90C 'modifi':76C 'object.prototype':77C 'organ':110C 'padloc':61C 'pass':96C 'patch':82C 'path':83C,89C 'pollut':68C,100C 'process':104C 'proto':91C 'prototyp':67C 'request':106C 'scim':72C,81C 'scimserver._handlescimuserspatch':85C 'send':79C 'server':103C 'setpath':98C 'share':102C 'suppli':88C 'token':73C 'vulner':69C 'x':92C,95C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T10:36:44+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:H/SC:N/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126570","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126570","severity":null,"published_at":"2026-11-11T03:16:51+00:00","modified_at":"2026-11-11T03:16:51+00:00","first_seen_at":"2026-11-11T03:25:00+00:00","fetched_at":"2026-11-11T03:25:00+00:00","note":null}],"documents":[{"id":122058,"url":"https://github.com/padloc/padloc/commit/7dd3d230ef299c71ac215c802600b5f2358f7ba3","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":122059,"url":"https://github.com/padloc/padloc/security/advisories/GHSA-crhv-mjrg-8vwm","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-10T10:36:44+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":122060,"url":"https://www.vulncheck.com/advisories/padloc-4.0.0-before-4.3.1-prototype-pollution-via-scim-patch-setpath","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}