{"vulnerability": "CVE-2026-48170", "sightings": [{"uuid": "3a984043-2e7d-4846-9a56-d9109b8f2de7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-48170", "type": "published-proof-of-concept", "source": "https://github.com/thomaspoignant/scim-patch/security/advisories/GHSA-9m6g-wc8r-q59c", "content": "", "creation_timestamp": "2026-05-21T13:04:48.000000Z"}, {"uuid": "da4debd7-723f-4a9e-b198-8d99b313b7f0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48170", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3mowbt3vgh62r", "content": "\u26a0\ufe0f PATCH NOW\n\nOne account-sync message can corrupt every object in your app.\n\nA widely-used identity library, scim-patch, applies the update straight onto JavaScript's shared prototype, and admin checks can flip true.\n\nPatch to 0.9.1 now. (CVE-2026-48170)", "creation_timestamp": "2026-06-23T01:47:50.618705Z"}]}