Missing Authentication Vulnerability in Padloc Product by Padloc

CVE-2026-121454

What is CVE-2026-121454?

Padloc up to version 4.3.0 is vulnerable to a missing authentication issue in the ScimServer._handleScimGet() method, allowing attackers to exploit the SCIM API. By sending any non-empty bearer token, unauthenticated users can gain unauthorized access to sensitive SCIM directory information. If an attacker knows the organization ID, they can retrieve critical data such as usernames, emails, names, external IDs, and group memberships through the Users and Groups SCIM endpoints, posing a significant security risk.

References