CVE-2026-121454 in Padloc
Summary
by MITRE • 11/03/2026
Padloc through 4.3.0 contains a missing authentication vulnerability in ScimServer._handleScimGet() that allows unauthenticated attackers to read SCIM directories by sending any non-empty bearer token. Attackers who know an organization id can query the Users and Groups SCIM endpoints to retrieve provisioned usernames, emails, names, externalIds, and group memberships.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified in Padloc versions up to 4.3.0 represents a critical failure in access control mechanisms within its System for Cross-domain Identity Management server implementation. Specifically, the flaw resides in the ScimServer._handleScimGet() function, which is responsible for processing incoming requests to retrieve data from SCIM directories. The core technical deficiency lies in the authentication logic, where the system incorrectly validates bearer tokens by merely checking if they are non-empty rather than verifying their authenticity or validity against a trusted identity provider. This oversight allows any string provided as an Authorization header to bypass security checks, effectively granting unauthenticated access to sensitive directory information for anyone who possesses a valid organization identifier.
From a technical perspective, this flaw constitutes a classic case of broken object level authorization combined with insufficient authentication validation. By accepting any non-empty bearer token, the application fails to ensure that the requester has been properly authenticated or authorized to view the specific resources being requested. This misconfiguration means that an attacker does not need valid credentials for the Padloc service itself; they only require knowledge of a target organization's ID. Once this identifier is known, which may be discoverable through public APIs, social engineering, or other information disclosure vectors, the attacker can interact directly with the Users and Groups SCIM endpoints to extract structured data about the organization's identity infrastructure.
The operational impact of this vulnerability is significant due to the sensitivity of the data exposed. Successful exploitation allows an adversary to retrieve a comprehensive profile of users within the targeted organization, including usernames, email addresses, full names, external identifiers, and group memberships. This information serves as high-value intelligence for subsequent attack phases such as spear-phishing campaigns, credential stuffing attacks, or social engineering efforts aimed at specific individuals based on their roles and relationships within the company. The exposure of group memberships is particularly dangerous as it reveals organizational hierarchy and access privileges, enabling attackers to prioritize targets with elevated permissions or sensitive data access rights.
This vulnerability aligns closely with CWE-287, which describes Improper Authentication, specifically where an entity fails to adequately prove its identity before being granted access to resources. Furthermore, the exploitation technique maps directly to MITRE ATT&CK tactic TA0001 Initial Access and sub-technique T1596.004 Search Open Technical Databases for Organization Information, as attackers can leverage publicly available or easily guessed organization IDs to harvest identity data that facilitates further intrusion activities. The ability to enumerate users and groups without authentication also relates to CWE-200, Exposure of Sensitive Information to an Unauthorized Actor, highlighting the risk of information leakage through misconfigured API endpoints.
Mitigation strategies must focus on correcting the fundamental authentication logic within the ScimServer component. Developers should implement strict validation that ensures bearer tokens are not only present but also cryptographically valid and issued by a trusted authority for the specific organization being queried. This involves verifying token signatures, checking expiration times, and ensuring the token contains claims authorizing access to the requested resource scope. Additionally, implementing rate limiting on SCIM endpoints can help mitigate automated enumeration attacks even if authentication is bypassed temporarily. Organizations should also audit their API configurations to ensure that sensitive identity management interfaces are not exposed without robust security controls and consider restricting access to these endpoints based on IP allow-listing or additional multi-factor verification for administrative functions.