Search
Find a vulnerability
Search criteria
3 vulnerabilities found for padloc by padloc
CVE-2026-126571 (GCVE-0-2026-126571)
Vulnerability from cvelistv5 – Published: 2026-11-11 02:36 – Updated: 2026-11-11 02:36
VLAI
EPSS
VEX
Title
Padloc 4.0.0 before 4.3.1 Email MFA Code Brute Force via retrieveMFAToken
Summary
Padloc 4.0.0 before 4.3.1 contains an authentication bypass vulnerability in the legacy retrieveMFAToken handler that never counts wrong email verification codes toward the attempt limit. Unauthenticated attackers knowing a victim's email can brute force the 6-digit code to obtain verification tokens usable in signup, login and account recovery flows.
Severity
4.8 (Medium)
CWE
- CWE-307 - Improper Restriction of Excessive Authentication Attempts
Assigner
VulnCheck
CNA
References
4 references
| URL | Tags |
|---|---|
| https://github.com/padloc/padloc/security/advisor… | vendor-advisory |
| https://github.com/padloc/padloc/commit/26f292515… | patch |
| https://github.com/padloc/padloc/blob/v4.3.0/pack… | technical-description |
| https://www.vulncheck.com/advisories/padloc-4.0.0… | third-party-advisory |
Impacted products
Date Public
2026-11-10 10:36
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/padloc/padloc",
"product": "padloc",
"repo": "https://github.com/padloc/padloc",
"vendor": "padloc",
"versions": [
{
"lessThan": "4.3.1",
"status": "affected",
"version": "4.0.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "4.3.1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Zachariah Mithani (AploSec)"
}
],
"datePublic": "2026-11-10T10:36:46.000Z",
"descriptions": [
{
"lang": "en",
"value": "Padloc 4.0.0 before 4.3.1 contains an authentication bypass vulnerability in the legacy retrieveMFAToken handler that never counts wrong email verification codes toward the attempt limit. Unauthenticated attackers knowing a victim\u0027s email can brute force the 6-digit code to obtain verification tokens usable in signup, login and account recovery flows."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-307",
"description": "Improper Restriction of Excessive Authentication Attempts",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-11T02:36:06.963Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-3mq5-m2qg-fqhq)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/padloc/padloc/security/advisories/GHSA-3mq5-m2qg-fqhq"
},
{
"tags": [
"patch"
],
"url": "https://github.com/padloc/padloc/commit/26f292515fe623826070454872f9cee08b756544"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/padloc/padloc/blob/v4.3.0/packages/core/src/v3-compat.ts#L191-L210"
},
{
"name": "VulnCheck Advisory: Padloc 4.0.0 before 4.3.1 Email MFA Code Brute Force via retrieveMFAToken",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/padloc-4.0.0-before-4.3.1-email-mfa-code-brute-force-via-retrievemfatoken"
}
],
"title": "Padloc 4.0.0 before 4.3.1 Email MFA Code Brute Force via retrieveMFAToken",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-126571",
"datePublished": "2026-11-11T02:36:06.963Z",
"dateReserved": "2026-11-11T02:18:34.574Z",
"dateUpdated": "2026-11-11T02:36:06.963Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-126570 (GCVE-0-2026-126570)
Vulnerability from cvelistv5 – Published: 2026-11-11 02:36 – Updated: 2026-11-11 02:36
VLAI
EPSS
VEX
Title
Padloc 4.0.0 before 4.3.1 Prototype Pollution via SCIM PATCH setPath()
Summary
Padloc 4.0.0 before 4.3.1 contains a prototype pollution vulnerability that allows SCIM token holders to modify Object.prototype by sending crafted SCIM PATCH paths to ScimServer._handleScimUsersPatch(). Attackers can supply paths like __proto__.x or constructor.prototype.x passed to setPath() to pollute the shared server process, disrupting requests for all other organizations.
Severity
CWE
- CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://github.com/padloc/padloc/security/advisor… | vendor-advisory |
| https://github.com/padloc/padloc/commit/7dd3d230e… | patch |
| https://github.com/padloc/padloc/blob/v4.3.0/pack… | technical-description |
| https://github.com/padloc/padloc/blob/v4.3.0/pack… | technical-description |
| https://www.vulncheck.com/advisories/padloc-4.0.0… | third-party-advisory |
Impacted products
Date Public
2026-11-10 10:36
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/padloc/padloc",
"product": "padloc",
"repo": "https://github.com/padloc/padloc",
"vendor": "padloc",
"versions": [
{
"lessThan": "4.3.1",
"status": "affected",
"version": "4.0.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "4.3.1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Zachariah Mithani (AploSec)"
}
],
"datePublic": "2026-11-10T10:36:44.000Z",
"descriptions": [
{
"lang": "en",
"value": "Padloc 4.0.0 before 4.3.1 contains a prototype pollution vulnerability that allows SCIM token holders to modify Object.prototype by sending crafted SCIM PATCH paths to ScimServer._handleScimUsersPatch(). Attackers can supply paths like __proto__.x or constructor.prototype.x passed to setPath() to pollute the shared server process, disrupting requests for all other organizations."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:H/SC:N/SI:L/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1321",
"description": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-11T02:36:06.228Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-crhv-mjrg-8vwm)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/padloc/padloc/security/advisories/GHSA-crhv-mjrg-8vwm"
},
{
"tags": [
"patch"
],
"url": "https://github.com/padloc/padloc/commit/7dd3d230ef299c71ac215c802600b5f2358f7ba3"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/padloc/padloc/blob/v4.3.0/packages/server/src/scim.ts#L421-L428"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/padloc/padloc/blob/v4.3.0/packages/core/src/util.ts#L239-L251"
},
{
"name": "VulnCheck Advisory: Padloc 4.0.0 before 4.3.1 Prototype Pollution via SCIM PATCH setPath()",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/padloc-4.0.0-before-4.3.1-prototype-pollution-via-scim-patch-setpath"
}
],
"title": "Padloc 4.0.0 before 4.3.1 Prototype Pollution via SCIM PATCH setPath()",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-126570",
"datePublished": "2026-11-11T02:36:06.228Z",
"dateReserved": "2026-11-11T02:18:34.190Z",
"dateUpdated": "2026-11-11T02:36:06.228Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121454 (GCVE-0-2026-121454)
Vulnerability from cvelistv5 – Published: 2026-11-03 15:17 – Updated: 2026-11-11 02:37
VLAI
EPSS
VEX
Title
Padloc before 4.3.1 Missing SCIM Token Validation via SCIM GET Requests
Summary
Padloc before 4.3.1 contains a missing authentication vulnerability in ScimServer._handleScimGet() that allows unauthenticated attackers to read SCIM directories by sending any non-empty bearer token. Attackers who know an organization id can query the Users and Groups SCIM endpoints to retrieve provisioned usernames, emails, names, externalIds, and group memberships.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-07 03:05 UTC
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://github.com/padloc/padloc/issues/795 | issue-tracking |
| https://github.com/padloc/padloc | product |
| https://github.com/padloc/padloc/commit/90dda7c6f… | patch |
| https://github.com/padloc/padloc/blob/v4.3.0/pack… | technical-description |
| https://www.vulncheck.com/advisories/padloc-throu… | third-party-advisory |
Impacted products
Date Public
2026-10-25 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121454",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-07T03:05:53.763165Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-07T03:06:24.553Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/padloc/padloc/issues/795"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/padloc/padloc",
"product": "padloc",
"vendor": "padloc",
"versions": [
{
"lessThan": "4.3.1",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "4.3.1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-10-25T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Padloc before 4.3.1 contains a missing authentication vulnerability in ScimServer._handleScimGet() that allows unauthenticated attackers to read SCIM directories by sending any non-empty bearer token. Attackers who know an organization id can query the Users and Groups SCIM endpoints to retrieve provisioned usernames, emails, names, externalIds, and group memberships."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-11T02:37:14.675Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #795",
"tags": [
"issue-tracking"
],
"url": "https://github.com/padloc/padloc/issues/795"
},
{
"tags": [
"product"
],
"url": "https://github.com/padloc/padloc"
},
{
"name": "Fix commit",
"tags": [
"patch"
],
"url": "https://github.com/padloc/padloc/commit/90dda7c6f417b28bee86ec60eff532eb18870125"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/padloc/padloc/blob/v4.3.0/packages/server/src/scim.ts#L702-L714"
},
{
"name": "VulnCheck Advisory: Padloc through 4.3.0 Missing SCIM Token Validation via SCIM GET Requests",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/padloc-through-4.3.0-missing-scim-token-validation-via-scim-get-requests"
}
],
"title": "Padloc before 4.3.1 Missing SCIM Token Validation via SCIM GET Requests",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-121454",
"datePublished": "2026-11-03T15:17:03.132Z",
"dateReserved": "2026-11-03T12:33:53.717Z",
"dateUpdated": "2026-11-11T02:37:14.675Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}