CVE-2026-53959

Name of the Vulnerable Software and Affected Versions 4gaBoards versions prior to 3.3.9

Description An issue exists where any authenticated user can enumerate account information for all users and retrieve arbitrary account details. This occurs because the users/index and users/show actions rely solely on a general authentication policy without requester-specific authorization or response sanitization. Specifically, the sails.helpers.users.getMany() function returns sensitive data. The affected API endpoints are 'GET /api/users' and 'GET /api/users/:id'. Exposed information includes email, phone, organization, name, isAdmin, ssoGoogleEmail, and ssoGithubEmail, including data belonging to administrators, which may facilitate privacy loss and targeted phishing reconnaissance.

Recommendations Update to version 3.3.9.