Padloc - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/padloc/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 11 Nov 2026 13:54:00 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgPadloc: Prototype pollution vulnerability in SCIM API (CVE-2026-126570)https://feed.craftedsignal.io/briefs/2026-11-padloc-prototype-pollution-cve-2026-126570/Wed, 11 Nov 2026 13:54:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-padloc-prototype-pollution-cve-2026-126570/Padloc versions 4.0.0 through 4.3.0 are vulnerable to prototype pollution via crafted SCIM PATCH requests, allowing authenticated attackers to modify Object.prototype and disrupt server processes.Padloc versions 4.0.0 through 4.3.0 contain a prototype pollution vulnerability in the ScimServer._handleScimUsersPatch() function. An attacker possessing a valid SCIM token can exploit this by submitting crafted PATCH requests containing malicious paths, such as __proto__.x or constructor.prototype.x. These inputs are processed by the setPath() method, resulting in the pollution of the global Object.prototype. This modification affects the shared server process, potentially leading to service disruption for all organizations hosted on the affected instance.

Impact

Successful exploitation allows for the modification of the base JavaScript object prototype, which can alter the behavior of the entire Node.js process. This may result in widespread service disruption for all users or organizations sharing the vulnerable server instance.

Recommendation

  • Update Padloc to version 4.3.1 or later immediately to address CVE-2026-126570.
  • Restrict the issuance and management of SCIM tokens to trusted administrators and automate rotation to minimize the risk of unauthorized access.
  • Audit SCIM PATCH request logs for suspicious path parameters matching patterns like __proto__ or constructor.
]]>highadvisory