CVE-2026-126570: Padloc 4.0.0 before 4.3.1 Prototype Pollution via SCIM PATCH setPath()
Padloc 4.0.0 before 4.3.1 contains a prototype pollution vulnerability that allows SCIM token holders to modify Object.prototype by sending crafted SCIM PATCH paths to ScimServer.handleScimUsersPatch(). Attackers can supply paths like proto.x or constructor.prototype.x passed to setPath() to pollute the shared server process, disrupting requests for all other organizations.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Padlocto a version that resolves this vulnerability.Fixed in 4.3.1
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs a SCIM token and must be able to send crafted SCIM PATCH requests to the affected SCIM user PATCH handler. The issue affects Padloc versions from 4.0.0 up to, but not including, 4.3.1.
What is the practical impact in a shared deployment?
Successful exploitation pollutes Object.prototype in the shared server process. This can disrupt requests for other organizations handled by that process, so the impact is not limited to the organization associated with the compromised SCIM token.
What request content indicates an exploitation attempt?
Look for SCIM PATCH paths containing prototype-related segments such as __proto__.x or constructor.prototype.x. These paths are passed to setPath() and can modify Object.prototype in affected versions.