CVE-2026-121454
Low · 3.7CVSS
3.7
EPSS
0.3%
Published
Nov 3, 2026
CISA due date
—
The record
Padloc through 4.3.0 contains a missing authentication vulnerability in ScimServer._handleScimGet() that allows unauthenticated attackers to read SCIM directories by sending any non-empty bearer token. Attackers who know an organization id can query the Users and Groups SCIM endpoints to retrieve provisioned usernames, emails, names, externalIds, and group memberships.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-121736 NocoDB 0.300.0 before 2026.08.0 contains a missing authentication vulnerability in the… CWE-306
- CVE-2022-29966 Emerson Ovation has several protocols that have no authentication, which could allow an… CWE-306
- CVE-2026-63482 Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics… CWE-306
- CVE-2026-121557 WPPConnect Server through 2.10.74 contains a missing authentication vulnerability that… CWE-306
- CVE-2026-121555 Foxel through 2.4.0 contains a missing authentication vulnerability that allows… CWE-306
- CVE-2026-119740 Nexbox A95X TV boxes built on the Amlogic S905X platform contain an unauthenticated… CWE-306
- CVE-2026-119731 Munshi (by Petpooja) before 2026-06-30 contained a payment bypass vulnerability in its… CWE-306
- CVE-2026-88810 A privilege escalation issue was discovered in Rancher Manager's role-based access… CWE-306