Prototype Pollution Vulnerability in Padloc Affected by SCIM Token Exploitation
CVE-2026-126570

7HIGH

Key Information:

Vendor

Padloc

Status
Padloc
Vendor
CVE Published:
11 November 2026

What is CVE-2026-126570?

A prototype pollution vulnerability exists in Padloc versions before 4.3.1 that enables SCIM token holders to disrupt server operations by sending maliciously crafted SCIM PATCH paths. This allows attackers to modify the Object.prototype by supplying paths like proto.x or constructor.prototype.x into the setPath() method during requests to ScimServer._handleScimUsersPatch(). Such exploitation could lead to significant disruptions affecting other organizations using the same shared server process.

Affected Version(s)

padloc 4.0.0 < 4.3.1

padloc 4.3.1

References

https://github.com/padloc/padloc/security/advisories/GHSA...
vendor-advisory
https://github.com/padloc/padloc/commit/7dd3d230ef299c71a...
patch
https://github.com/padloc/padloc/blob/v4.3.0/packages/ser...
technical-description

CVSS V4

Score:
7
Severity:
HIGH
Confidentiality:
None
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Zachariah Mithani (AploSec)
.