CVE-2026-53959: 4gaBoards: Mass Information Disclosure (Internal PII Leakage) on /api/users to any authenticated user
4gaBoards is a boards system for realtime project management. Prior to 3.3.9, 4gaBoards allows any authenticated user to enumerate account information for every user through GET /api/users and retrieve arbitrary accounts through GET /api/users/:id. The users/index and users/show actions rely only on the default is-authenticated policy in server/config/policies.js, and server/api/controllers/users/index.js returns the result of sails.helpers.users.getMany() without requester-specific authorization or response sanitization. Responses expose email, phone, organization, name, isAdmin, ssoGoogleEmail, ssoGithubEmail, and other SSO-linked email fields, including data for administrators. This enables instance-wide user enumeration, privacy loss, and targeted phishing reconnaissance. This issue is fixed in version 3.3.9.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
4gaBoardsto a version that resolves this vulnerability.Fixed in 3.3.9
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated 4gaBoards user can access the affected endpoints; administrator privileges are not required. The exposure includes information for all accounts, including administrators.
What does an attacker need to exploit it?
An attacker needs only a valid authenticated account and network access to the application. No user interaction or elevated permissions are required.
Are standard authenticated deployments affected?
The affected users/index and users/show actions rely solely on the default is-authenticated policy, so ordinary authenticated users are affected by the described authorization gap.
How can I investigate whether the issue has been abused?
Review access logs for GET requests to /api/users and /api/users/:id from non-administrative accounts, particularly requests that enumerate many user IDs. Upgrade to version 3.3.9 to address the issue.