Vulnerability Description
4gaBoards is a boards system for realtime project management. Prior to 3.3.9, 4gaBoards allows any authenticated user to enumerate account information for every user through GET /api/users and retrieve arbitrary accounts through GET /api/users/:id. The users/index and users/show actions rely only on the default is-authenticated policy in server/config/policies.js, and server/api/controllers/users/index.js returns the result of sails.helpers.users.getMany() without requester-specific authorization or response sanitization. Responses expose email, phone, organization, name, isAdmin, ssoGoogleEmail, ssoGithubEmail, and other SSO-linked email fields, including data for administrators. This enables instance-wide user enumeration, privacy loss, and targeted phishing reconnaissance. This issue is fixed in version 3.3.9.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/RARgames/4gaBoards/commit/93099d913cbfdbb1799b4aca19d2d0c2d2a
- https://github.com/RARgames/4gaBoards/releases/tag/v3.3.9
- https://github.com/RARgames/4gaBoards/security/advisories/GHSA-p77f-p47g-h72p
- https://github.com/RARgames/4gaBoards/security/advisories/GHSA-p77f-p47g-h72p
FAQ
What is CVE-2026-53959?
CVE-2026-53959 is a vulnerability with a CVSS score of 6.5 (MEDIUM). 4gaBoards is a boards system for realtime project management. Prior to 3.3.9, 4gaBoards allows any authenticated user to enumerate account information for every user through GET /api/users and retriev...
How severe is CVE-2026-53959?
CVE-2026-53959 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-53959?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.