PT-2026-136215
CVE-2026-121454
·
Published
2026-11-03
·
Updated
2026-11-03
Description by
CVSS 3.1
3.7
LowMetricsAV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Padloc through 4.3.0 contains a missing authentication vulnerability in ScimServer. handleScimGet() that allows unauthenticated attackers to read SCIM directories by sending any non-empty bearer token. Attackers who know an organization id can query the Users and Groups SCIM endpoints to retrieve provisioned usernames, emails, names, externalIds, and group memberships.
Found an issue in the description? Have something to add? Feel free to write us 👾