CVE-2026-53959

Received Received - Intake

Authenticated User Enumeration in 4gaBoards

Publication date: 2026-08-18

Last updated on: 2026-08-21

Assigner: GitHub, Inc.

Description

4gaBoards is a boards system for realtime project management. Prior to 3.3.9, 4gaBoards allows any authenticated user to enumerate account information for every user through GET /api/users and retrieve arbitrary accounts through GET /api/users/:id. The users/index and users/show actions rely only on the default is-authenticated policy in server/config/policies.js, and server/api/controllers/users/index.js returns the result of sails.helpers.users.getMany() without requester-specific authorization or response sanitization. Responses expose email, phone, organization, name, isAdmin, ssoGoogleEmail, ssoGithubEmail, and other SSO-linked email fields, including data for administrators. This enables instance-wide user enumeration, privacy loss, and targeted phishing reconnaissance. This issue is fixed in version 3.3.9.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-21

Generated

2026-09-08

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-06

NVD

CVE-2026-53959

Affected Vendors & Products

Vendor	Product	Version / Range
4gaboards	4gaboards	3.3.9

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This vulnerability in 4gaBoards before version 3.3.9 allows any authenticated user to access sensitive user data through two API endpoints. The GET /api/users endpoint exposes all user accounts, while GET /api/users/:id retrieves specific accounts. The system fails to enforce proper authorization checks, leaking emails, phone numbers, organization details, names, admin status, and SSO-linked email fields.

Detection Guidance

Check if your 4gaBoards instance is running a version prior to 3.3.9. Use commands like curl to query the vulnerable endpoints: curl -X GET http://your-server/api/users and curl -X GET http://your-server/api/users/:id where :id is a user ID. If responses include sensitive user data without proper authorization, the system is vulnerable.

Impact Analysis

An attacker could exploit this to gather private user information across the entire platform. This enables large-scale user enumeration, privacy breaches, and targeted phishing attacks against administrators or specific users. The exposed data could be used for social engineering or further attacks.

Compliance Impact

This vulnerability likely violates GDPR due to unauthorized processing of personal data and insufficient protection of user information. It may also breach HIPAA if user data includes protected health information. Organizations using affected versions risk non-compliance penalties and loss of trust.

Mitigation Strategies

Upgrade 4gaBoards to version 3.3.9 or later immediately. Review and restrict access to the /api/users and /api/users/:id endpoints. Implement proper authorization checks to ensure only authorized users can access user data. Audit logs for unauthorized access attempts.

Hi! I’m here to help you understand CVE-2026-53959. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70