Is CVE-2026-121454 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-121454?

CVE-2026-121454 has a CVSS v3 severity of LOW (3.7).

Back

CVE-2026-121454

Description

Padloc through 4.3.0 contains a missing authentication vulnerability in ScimServer._handleScimGet() that allows unauthenticated attackers to read SCIM directories by sending any non-empty bearer token. Attackers who know an organization id can query the Users and Groups SCIM endpoints to retrieve provisioned usernames, emails, names, externalIds, and group memberships.