EUVD-2026-115886Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify Padloc instance with SCIM enabled
-
ExploitObtain target organization id
-
ExecutionSend SCIM GET with arbitrary bearer token
-
ImpactHarvest provisioned user and group directory data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that SCIM directory provisioning is configured for the target organization (org.directory.scim must be set - the fixed code returns HTTP 400 'SCIM has not been configured' otherwise), and the attacker must know the target organization id, which is supplied in the request URL path. Given those, any non-empty bearer token supplied via the Authorization header or the ?token= query parameter is accepted, because the original _handleScimGet() path performed no comparison against the configured SCIM secret. Limiting factors: the flaw is read-only (confidentiality only - no modification of directory data), it exposes only SCIM directory metadata (usernames, emails, names, externalIds, group memberships), and it is inert on instances where SCIM provisioning is not enabled. |
| Impact | This is a genuine but moderate-priority confidentiality issue. The CVSS 4.0 base score is 6.3 (medium), and all signals point to limited impact rather than critical risk: VC:L/VI:N/VA:N means read-only disclosure of directory metadata with no integrity or availability impact. The attack is network-reachable (AV:N) and low-complexity (AC:L) with no privileges or user interaction (PR:N/UI:N), but AT:P correctly reflects two real preconditions - SCIM provisioning must be configured for the target org and the attacker must know the organization id. No CISA KEV listing is present and no EPSS score was provided, so there is no evidence of widespread or active exploitation; combined with the absence of any public exploit code, this reads as a disclosed-and-patched flaw rather than an actively-weaponized one. The vuln.today decision label is 'this_month', consistent with a medium-severity information-disclosure bug that should be patched on a routine-but-not-emergency cadence. The main caveat: EPSS is missing, so exploitation probability cannot be quantified from the supplied data. |
| Exploit ScenarioDerived | An attacker who learns a Padloc organization id for an instance with SCIM provisioning enabled sends an HTTP GET to the Users or Groups SCIM endpoint with any arbitrary non-empty bearer token (via the Authorization header or ?token= query parameter). Because ScimServer._handleScimGet() never validates the token against the configured SCIM secret, the server returns provisioned usernames, emails, display names, externalIds, and group memberships. No public exploit code is identified, but the vulnerable code path and the fixing commit are publicly visible. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 03, 2026
Unauthenticated SCIM directory read in Padloc through 4.3.0 lets remote attackers retrieve provisioned user and group records - usernames, emails, names, externalIds and group memberships - from the SCIM endpoints of any organization that has directory provisioning configured, simply by supplying any non-empty bearer token. The attacker must know the target organization id, which is embedded in the SCIM request URL path, and the flaw is read-only: it exposes directory metadata but does not permit modification of directory data and is inert where SCIM provisioning is not enabled. Severity is moderate (CVSS 4.0 base 6.3; assessed CVSS 3.1 6.3, confidentiality-only) with priority 'this_month'; no public exploit code or active exploitation has been identified at time of analysis.
RemediationAI
Patch status: upstream fix available (commit 90dda7c6f417b28bee86ec60eff532eb18870125); a released patched version number beyond 4.3.0 is not independently confirmed, so track the Padloc repository (https://github.com/padloc/padloc) and issue https://github.com/padloc/padloc/issues/795 for the tagged release and apply it as soon as it is published - the change adds a timing-safe comparison of the presented token against org.directory.scim.secret and rejects mismatched, malformed, missing and unknown-org requests with 401/404/400. Compensating controls until then: if SCIM provisioning is not in use, unset the organization's SCIM settings (org.directory.scim), which the fixed code treats as 'SCIM has not been configured' and which removes the data path the handler reads - the trade-off is that any legitimate IdP provisioning stops working. Alternatively, restrict inbound access to the SCIM endpoints (/{orgId}/Users, /{orgId}/Groups and their /{id} variants) to the identity provider's source addresses at a reverse proxy or firewall, accepting that this only narrows the attack surface and must be kept in sync with the IdP egress ranges. Because the request requires knowing the organization id, avoid exposing organization ids in URLs, logs or client-side artifacts that are broadly readable, though this is obfuscation rather than a fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Padloc is a TypeScript/Node.js password manager whose server package implements a SCIM 2.0 directory provider in packages/server/src/scim.ts. The vulnerable code is ScimServer._handleScimGet() (lines 702-714 as of tag v4.3.0), the handler behind GET requests to the /{orgId}/Users and /{orgId}/Groups endpoints that return SCIM list responses. This is CWE-306 (Missing Authentication for Critical Function): the handler extracted a bearer token from the Authorization header (or the ?token= query parameter) and, if it was non-empty, proceeded to look up the organization's provisioning records and return directory contents without ever comparing the presented value against the organization's configured SCIM secret (org.directory.scim.secret). The upstream fix at commit 90dda7c6f417b28bee86ec60eff532eb18870125 adds the missing comparison using the crypto provider's timingSafeEqual, returns 401 'Invalid SCIM Secret Token' on mismatch (including malformed tokens that throw during base64 decoding), returns 404 when the organization id does not exist, and returns 400 when SCIM has not been configured for that org. The accompanying test suite in packages/server/test/scim.ts exercises both the header and query-parameter token paths, missing tokens, unconfigured SCIM, and orphaned provisioning data. Exact affected product range is captured by the wildcard CPE cpe:2.3:a:padloc:padloc:*:*:*:*:*:*:*:*, i.e. all releases up to and including 4.3.0.
Know when Padloc gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Remote, unauthenticated (any token accepted) with no UI, so AV:N/AC:L/PR:N/UI:N; read-only directory-metadata disclosure gives C:L, I:N, A:N, S:U.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
Padloc through 4.3.0 contains a missing authentication vulnerability in ScimServer._handleScimGet() that allows unauthenticated attackers to read SCIM directories by sending any non-empty bearer token. Attackers who know an organization id can query the Users and Groups SCIM endpoints to retrieve provisioned usernames, emails, names, externalIds, and group memberships.
Threat Intelligence Overview
NVD
CVE.org
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB