Padloc: Prototype pollution vulnerability in SCIM API (CVE-2026-126570)

Padloc versions 4.0.0 through 4.3.0 contain a prototype pollution vulnerability in the ScimServer._handleScimUsersPatch() function. An attacker possessing a valid SCIM token can exploit this by submitting crafted PATCH requests containing malicious paths, such as __proto__.x or constructor.prototype.x. These inputs are processed by the setPath() method, resulting in the pollution of the global Object.prototype. This modification affects the shared server process, potentially leading to service disruption for all organizations hosted on the affected instance.

Impact

Successful exploitation allows for the modification of the base JavaScript object prototype, which can alter the behavior of the entire Node.js process. This may result in widespread service disruption for all users or organizations sharing the vulnerable server instance.

Recommendation

• Update Padloc to version 4.3.1 or later immediately to address CVE-2026-126570.
• Restrict the issuance and management of SCIM tokens to trusted administrators and automate rotation to minimize the risk of unauthorized access.
• Audit SCIM PATCH request logs for suspicious path parameters matching patterns like __proto__ or constructor.