CVE-2026-126570

Padloc versions 4.0.0 before 4.3.1 are vulnerable to a prototype pollution vulnerability within the ScimServer._handleScimUsersPatch() function. By sending crafted SCIM PATCH paths —specifically paths such as __proto__.x or constructor.prototype.x—to the setPath() method, authenticated SCIM token...