CVE-2026-53959: 4gaBoards Information Disclosure Flaw

CVE-2026-53959 Overview

CVE-2026-53959 is an information disclosure vulnerability in 4gaBoards, an open-source realtime project management boards system. Any authenticated user can enumerate all accounts through GET /api/users and retrieve arbitrary user records through GET /api/users/:id. The exposed data includes email addresses, phone numbers, organization, name, isAdmin flag, and linked SSO identifiers such as ssoGoogleEmail and ssoGithubEmail. Administrator records are included in the response. The issue affects versions prior to 3.3.9 and is tracked under [CWE-200].

Critical Impact
Any authenticated user can harvest personally identifiable information (PII) and identify administrator accounts across the entire instance, enabling targeted phishing and account takeover reconnaissance.

Affected Products

4gaBoards versions prior to 3.3.9
server/api/controllers/users/index.js (users/index and users/show actions)
server/config/policies.js (default is-authenticated policy)

Discovery Timeline

2026-08-18 - CVE-2026-53959 published to NVD
2026-08-18 - Last updated in NVD database
v3.3.9 - Fix released by the 4gaBoards project

Technical Details for CVE-2026-53959

Vulnerability Analysis

The vulnerability stems from missing per-request authorization on user-listing endpoints. The users/index and users/show actions in server/api/controllers/users/index.js invoke sails.helpers.users.getMany() and return the result without sanitization. The controller relies solely on the default is-authenticated policy declared in server/config/policies.js, so any user with a valid session receives full user records.

Because responses include email, phone, organization, name, isAdmin, ssoGoogleEmail, ssoGithubEmail, and other SSO-linked email fields, an authenticated attacker gains complete visibility into instance membership. The isAdmin flag lets an attacker immediately identify high-value accounts. SSO email fields extend the disclosure into linked identity providers, exposing corporate email conventions and third-party account identifiers.

Root Cause

The controller returns raw records from sails.helpers.users.getMany() without invoking a sanitization helper and without evaluating whether the requesting user is entitled to view administrative fields or other users' PII. Access control is authentication-only, not authorization-aware.

Attack Vector

An attacker registers or logs in as any low-privilege user, then issues GET /api/users to enumerate every account, or GET /api/users/:id to retrieve individual profiles. The endpoints require only a valid session cookie or bearer token.

javascript

// Fix applied in server/api/controllers/actions/index-attachment-actions.js
const actions = await sails.helpers.attachments.getActions(attachment.id, inputs.beforeId);
const userIds = sails.helpers.utils.mapRecords(actions, 'userId', true);
const users = await sails.helpers.users.getMany(userIds, true);
const sanitizedUsers = await sails.helpers.users.sanitize(users, currentUser);

return {
  items: actions,
  included: {
    users: sanitizedUsers,
  },
};

Source: GitHub Commit 93099d9. The patch introduces sails.helpers.users.sanitize(users, currentUser) to strip sensitive fields based on the requester's identity before responses are returned.

Detection Methods for CVE-2026-53959

Indicators of Compromise

High-volume GET /api/users requests from a single authenticated session within a short interval
Sequential or scripted access to GET /api/users/:id iterating over identifier ranges
Requests to /api/users originating from low-privilege accounts that do not use administrative UI features
Unusual outbound authentication response sizes returning full user arrays

Detection Strategies

Instrument the 4gaBoards reverse proxy or application logs to record request paths, session identifiers, and response sizes for /api/users*.
Alert on any single session issuing more than a small threshold of /api/users requests per minute.
Correlate /api/users/:id access patterns with the number of legitimate memberships a user holds; requests exceeding that scope indicate enumeration.

Monitoring Recommendations

Retain HTTP access logs for the 4gaBoards API tier for at least 90 days to support retrospective enumeration hunts.
Monitor for phishing campaigns targeting email addresses or SSO identifiers that appear in the 4gaBoards user directory following any suspected access.
Track newly created low-privilege accounts that immediately query /api/users after first login.

How to Mitigate CVE-2026-53959

Immediate Actions Required

Upgrade 4gaBoards to version 3.3.9 or later, which introduces sails.helpers.users.sanitize() and applies it to affected controllers.
Review application logs for prior enumeration attempts against /api/users and /api/users/:id.
Rotate any credentials or SSO linkages that may be targeted based on disclosed data.

Patch Information

The fix is available in 4gaBoards v3.3.9. The maintainer commit 93099d9 adds a sanitization helper invoked by the users controllers and related actions. Full details are published in GHSA-p77f-p47g-h72p.

Workarounds

If immediate upgrade is not possible, restrict network access to the 4gaBoards API to trusted networks and enforce short session lifetimes.
Add a reverse-proxy rule that denies /api/users and /api/users/:id requests from non-administrative accounts until the patch is applied.
Notify users to be alert for phishing attempts referencing internal project or organization details.

bash

# Example nginx rule blocking user listing endpoints at the proxy tier
location ~ ^/api/users(/.*)?$ {
    if ($cookie_role != "admin") {
        return 403;
    }
    proxy_pass http://4gaboards_backend;
}