CVE-2026-126570

Name of the Vulnerable Software and Affected Versions Padloc versions 4.0.0 through 4.3.0

Description SCIM token holders can modify Object.prototype by sending crafted SCIM PATCH paths to the ScimServer. handleScimUsersPatch() function. By providing paths such as proto .x or constructor.prototype.x to the setPath() function, an attacker can cause prototype pollution, which is a condition where an attacker manipulates the prototype of a base object to inject properties. This action pollutes the shared server process, resulting in the disruption of requests for all other organizations.

Recommendations Update Padloc to version 4.3.1 or later.