{"affected":[{"defaultStatus":"unaffected","ecosystem":"github","packageName":"padloc/padloc","product":"padloc","source":"CNA: VulnCheck","vendor":"padloc","versions":[{"lessThan":"4.3.1","status":"affected","version":"4.0.0","versionType":"semver"},{"status":"unaffected","version":"4.3.1","versionType":"semver"}]}],"cveId":"CVE-2026-126570","cwes":["CWE-1321"],"description":"Padloc 4.0.0 before 4.3.1 contains a prototype pollution vulnerability that allows SCIM token holders to modify Object.prototype by sending crafted SCIM PATCH paths to ScimServer._handleScimUsersPatch(). Attackers can supply paths like __proto__.x or constructor.prototype.x passed to setPath() to pollute the shared server process, disrupting requests for all other organizations.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":7,"severity":"high","source":"CNA: VulnCheck","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:H/SC:N/SI:L/SA:H","version":"4.0"},{"score":7.6,"severity":"high","source":"CNA: VulnCheck","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:H","version":"3.1"}],"modifiedAt":1794364566228,"publishedAt":1794364566228,"references":[{"source":"CNA: VulnCheck","tags":["vendor-advisory"],"url":"https://github.com/padloc/padloc/security/advisories/GHSA-crhv-mjrg-8vwm"},{"source":"CNA: VulnCheck","tags":["patch"],"url":"https://github.com/padloc/padloc/commit/7dd3d230ef299c71ac215c802600b5f2358f7ba3"},{"source":"CNA: VulnCheck","tags":["technical-description"],"url":"https://github.com/padloc/padloc/blob/v4.3.0/packages/server/src/scim.ts#L421-L428"},{"source":"CNA: VulnCheck","tags":["technical-description"],"url":"https://github.com/padloc/padloc/blob/v4.3.0/packages/core/src/util.ts#L239-L251"},{"source":"CNA: VulnCheck","tags":["third-party-advisory"],"url":"https://www.vulncheck.com/advisories/padloc-4.0.0-before-4.3.1-prototype-pollution-via-scim-patch-setpath"}],"remediation":[{"kind":"fix","source":"CNA: VulnCheck","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/padloc/padloc/commit/7dd3d230ef299c71ac215c802600b5f2358f7ba3"}],"revision":"a112d2d5a605e888afeb3fdcef022c973f957b6fa5794d8db4ccf8d31187085e","sources":[{"modifiedAt":1794364566228,"name":"CNA: VulnCheck","retrievedAt":1794366525417,"url":"https://www.cve.org/CVERecord?id=CVE-2026-126570"}],"ssvc":null,"status":"published","title":"Padloc 4.0.0 before 4.3.1 Prototype Pollution via SCIM PATCH setPath()","updatedAt":1794366525417}