Threats affecting pkg:github/padloc

Padloc versions up to 4.3.0 have a missing authentication vulnerability in the SCIM server component. This flaw allows unauthenticated attackers to access SCIM directories by sending any non-empty bearer token. With knowledge of an organization ID, attackers can query Users and Groups endpoints to retrieve sensitive user information including usernames, emails, names, external IDs, and group memberships.