CVE-2026-121454
Last modified
CVE-2026-121454 is a low-severity vulnerability rated 3.7/10 on the CVSS scale. Padloc through 4.3.0 contains a missing authentication vulnerability in ScimServer._handleScimGet() that allows unauthenticated attackers to read SCIM directories by sending any non-empty bearer token. Attackers who know an organization id can query the Users and Groups SCIM endpoints to retrieve provisioned usernames, emails, names, externalIds, and group memberships..
Description
Padloc through 4.3.0 contains a missing authentication vulnerability in ScimServer._handleScimGet() that allows unauthenticated attackers to read SCIM directories by sending any non-empty bearer token. Attackers who know an organization id can query the Users and Groups SCIM endpoints to retrieve provisioned usernames, emails, names, externalIds, and group memberships.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| padloc | padloc | <= 4.3.0 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-121454?
How severe is CVE-2026-121454?
How do I fix CVE-2026-121454?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-121448Dockhand before 1.0.54 contains a path traversal vulnerabili…8.3
- CVE-2026-121449Dockhand from 1.0.47 before 1.0.54 exposes plaintext stack s…6.5
- CVE-2026-121450CFNext before 3.1.0 contains a weak cryptographic derivation…7.5
- CVE-2026-121451AB Download Manager before 1.11.2 contains a cross-site requ…8.8
- CVE-2026-121452bbs-go through 4.4.6 contains an improper certificate valida…6.5
- CVE-2026-121453SQLBot through 1.10.3 contains a path traversal vulnerabilit…2.7
- CVE-2026-121455DbGate before 7.3.3 contains a missing authorization vulnera…5.4
- CVE-2026-121458Instatic before 0.0.21 contains a missing authorization vuln…6.5
- CVE-2026-12148IBM MQ Operator could allow an authenticated attacker to cau…8.8
- CVE-2026-121489Improper Limitation of a Pathname to a Restricted Directory …10
- CVE-2026-1215The MMA Call Tracking plugin for WordPress is vulnerable to …4.3
- CVE-2026-12150IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.4…7
Are you affected by CVE-2026-121454?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST