CVE-2026-53958

Received Received - Intake

4gaBoards Account Takeover via SSO Attribute Manipulation

Publication date: 2026-08-18

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description

4gaBoards is a boards system for realtime project management. Prior to 3.3.9, 4gaBoards allows an authenticated user to modify ssoGoogleId, ssoGoogleEmail, ssoGithubId, ssoGithubUsername, ssoGithubEmail, ssoMicrosoftId, ssoMicrosoftEmail, ssoOidcId, and ssoOidcEmail through PATCH /api/users/:id. The whitelist in server/api/controllers/users/update.js mass assigns these backend-managed identity attributes from user input. An attacker can place a victim's provider identifier on an attacker-controlled account, causing the default lookup in helpers such as server/api/helpers/users/get-create-one-for-github-sso.js to match the victim's first SSO login to the attacker's account before the email-linkage flow runs. The victim is logged into the attacker-controlled account, and projects, boards, or data the victim creates remain accessible through the attacker's original local credentials. This issue is fixed in version 3.3.9.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-19

Generated

2026-09-08

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-07

NVD

CVE-2026-53958

Affected Vendors & Products

Vendor	Product	Version / Range
4gaboards	4gaboards	3.3.9

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CWE-915	The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.

Attack-Flow Graph

Executive Summary

4gaBoards before version 3.3.9 has a vulnerability where an authenticated user can modify backend-managed identity attributes like SSO IDs and emails via a PATCH request. This allows an attacker to link a victim's provider identifier to their own account, causing the victim to be logged into the attacker's account instead. The victim's data remains accessible through the attacker's original credentials.

Detection Guidance

This vulnerability requires checking for unauthorized modifications to user accounts via PATCH requests to /api/users/:id. Monitor logs for suspicious PATCH requests targeting user endpoints, especially with parameters like ssoGoogleId, ssoGithubId, or ssoMicrosoftId. Verify user account associations in the database for unexpected provider ID mappings.

Impact Analysis

An attacker could gain access to your account and projects, potentially stealing sensitive data or manipulating your boards. Your projects and data may remain accessible through the attacker's account even after the initial compromise.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles or HIPAA's security requirements. It may result in data breaches, unauthorized disclosure, or loss of data integrity, requiring breach notifications and potential regulatory penalties.

Mitigation Strategies

Upgrade 4gaBoards to version 3.3.9 or later to address the vulnerability. Review user accounts for unauthorized changes to SSO attributes and revoke access for any suspicious accounts.

Hi! I’m here to help you understand CVE-2026-53958. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70