Threats tagged 'ghsa-8qrv-3gh4-gx4r'

Padloc versions through 4.3.0 have a missing authentication vulnerability in the ScimServer._handleScimGet() function. This flaw allows unauthenticated attackers to read SCIM directories by sending any non-empty bearer token. Attackers with knowledge of an organization ID can query Users and Groups SCIM endpoints to obtain usernames, emails, names, external IDs, and group memberships.