GHSA-crhv-mjrg-8vwm: Padloc 4.0.0 before 4.3.1 Prototype Pollution via SCIM PATCH setPath()

Published Nov 11, 2026

Updated

Padloc 4.0.0 before 4.3.1 contains a prototype pollution vulnerability that allows SCIM token holders to modify Object.prototype by sending crafted SCIM PATCH paths to ScimServer.handleScimUsersPatch(). Attackers can supply paths like proto.x or constructor.prototype.x passed to setPath() to pollute the shared server process, disrupting requests for all other organizations.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Padloc to a version that resolves this vulnerability.
Fixed in 4.3.1

Event History

Nov 11, 2026

CVE Published

via OSV·02:36 AM

Data Sourced

via OSV·02:36 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs to hold a SCIM token and be able to send crafted SCIM PATCH requests to the affected SCIM user patch handler. The attack is network-accessible and does not require user interaction.

What versions are affected and what version fixes it?

Padloc versions 4.0.0 before 4.3.1 are affected. Upgrading to 4.3.1 or later addresses the vulnerability.

What is the practical impact in a shared deployment?

Successful exploitation pollutes Object.prototype in the shared server process. This can disrupt requests for other organizations and affect integrity and availability beyond the attacker's own organization.

How can I identify attempted exploitation?

Inspect SCIM PATCH requests handled by the SCIM user patch endpoint for crafted paths containing __proto__ or constructor.prototype. These paths are passed to setPath() and are the identified prototype-pollution vectors.

GHSA-crhv-mjrg-8vwm: Padloc 4.0.0 before 4.3.1 Prototype Pollution via SCIM PATCH setPath()

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What versions are affected and what version fixes it?

What is the practical impact in a shared deployment?

How can I identify attempted exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What versions are affected and what version fixes it?

What is the practical impact in a shared deployment?

How can I identify attempted exploitation?