What’s Vulnerable › Vulnerabilities
CVE-2026-53959: 4gaBoards: Mass Information Disclosure (Internal PII Leakage) on /api/users to any authenticated user
- Severity: medium (CVSS 6.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 1.0% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-08-18 · updated 2026-10-22
- Weakness: CWE-200
Description
4gaBoards is a boards system for realtime project management. Prior to 3.3.9, 4gaBoards allows any authenticated user to enumerate account information for every user through GET /api/users and retrieve arbitrary accounts through GET /api/users/:id. The users/index and users/show actions rely only on the default is-authenticated policy in server/config/policies.js, and server/api/controllers/users/index.js returns the result of sails.helpers.users.getMany() without requester-specific authorization or response sanitization. Responses expose email, phone, organization, name, isAdmin, ssoGoogleEmail, ssoGithubEmail, and other SSO-linked email fields, including data for administrators. This enables instance-wide user enumeration, privacy loss, and targeted phishing reconnaissance. This issue is fixed in version 3.3.9.
Affected products
- RARgames 4gaBoards: before 3.3.9
In the news
References
- https://github.com/RARgames/4gaBoards/commit/93099d913cbfdbb1799b4aca19d2d0c2d2a276fb
- https://github.com/RARgames/4gaBoards/releases/tag/v3.3.9
- https://github.com/RARgames/4gaBoards/security/advisories/GHSA-p77f-p47g-h72p
- https://github.com/RARgames/4gaBoards/security/advisories/GHSA-p77f-p47g-h72p
Get alerted when CVE-2026-53959 or the next vulnerability affects your stack