CVE-2026-121454

Padloc versions through 4.3.0 are vulnerable to a missing authentication flaw in the ScimServer._handleScimGet() function. This vulnerability allows unauthenticated attackers to bypass security by providing any non-empty bearer token. If an attacker knows an organization ID, they can query the Us...