CVE-2026-50191

Received Received - Intake

Pre-Account Takeover in 4gaBoards via Unverified Local Registration

Publication date: 2026-08-18

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description

4gaBoards is a boards system for realtime project management. Prior to 3.3.8, 4gaBoards is vulnerable to pre-account takeover when registrationEnabled, localRegistrationEnabled, and ssoRegistrationEnabled are enabled and Google, GitHub, Microsoft, or OIDC SSO is configured. The POST /api/register endpoint permits creation of an unverified local account with a victim's email address, and POST /api/access-tokens permits that account to authenticate while isVerified is false. During the victim's first SSO login, server/api/helpers/users/get-create-one-for-github-sso.js, server/api/helpers/users/get-create-one-for-google-sso.js, server/api/helpers/users/get-create-one-for-microsoft-sso.js, and server/api/helpers/users/get-create-one-for-oidc-sso.js find the attacker-controlled account by email and link the verified SSO identity without confirming ownership of the local account. The attacker can retain local-password access to the linked account and obtain the victim's projects, data, and permissions. This issue is fixed in version 3.3.8.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-19

Generated

2026-09-08

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-06

NVD

CVE-2026-50191

Affected Vendors & Products

Vendor	Product	Version / Range
4gaboards	4gaboards	to 3.3.8 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CWE-288	The product requires authentication, but the product has an alternate path or channel that does not require authentication.

Attack-Flow Graph

Executive Summary

4gaBoards before version 3.3.8 has a pre-account takeover flaw when registration and SSO (Google, GitHub, Microsoft, OIDC) are enabled. An attacker can create an unverified local account using a victim's email via POST /api/register. Then, during the victim's first SSO login, the system links the verified SSO identity to the attacker's local account without confirming ownership. The attacker retains access to the victim's projects, data, and permissions.

Detection Guidance

To detect this vulnerability, check if your 4gaBoards instance is running a version prior to 3.3.8. Verify the configuration settings for registrationEnabled, localRegistrationEnabled, and ssoRegistrationEnabled. Inspect the POST /api/register and POST /api/access-tokens endpoints for unauthorized account creation. Review user accounts for unverified local accounts linked to SSO identities.

Impact Analysis

If you use 4gaBoards with registration and SSO enabled, an attacker could take over your account by creating a local account with your email. They could access your projects, data, and permissions even after you log in via SSO. This could lead to data theft, unauthorized changes, or loss of control over your projects.

Compliance Impact

This vulnerability could violate GDPR by exposing personal data without consent and failing to ensure data integrity. For HIPAA, it risks unauthorized access to protected health information, breaching confidentiality and integrity requirements. Compliance may be compromised due to lack of proper access controls and verification.

Mitigation Strategies

Upgrade 4gaBoards to version 3.3.8 or later to address the vulnerability. Disable registrationEnabled, localRegistrationEnabled, and ssoRegistrationEnabled if not required. Monitor accounts for unauthorized access or unverified registrations.

Hi! I’m here to help you understand CVE-2026-50191. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70