Description

4gaBoards is a boards system for realtime project management. Prior to 3.3.9, 4gaBoards allows any authenticated user to enumerate account information for every user through GET /api/users and retrieve arbitrary accounts through GET /api/users/:id. The users/index and users/show actions rely only on the default is-authenticated policy in server/config/policies.js, and server/api/controllers/users/index.js returns the result of sails.helpers.users.getMany() without requester-specific authorization or response sanitization. Responses expose email, phone, organization, name, isAdmin, ssoGoogleEmail, ssoGithubEmail, and other SSO-linked email fields, including data for administrators. This enables instance-wide user enumeration, privacy loss, and targeted phishing reconnaissance. This issue is fixed in version 3.3.9.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-18T22:16:54.907Z",
  "pubdate": "2026-08-18T22:16:54.907Z",
  "executiveSummary": "An unauthorized user enumeration vulnerability exists in 4gaBoards prior to version 3.3.9, impacting the real-time project management platform's user management API.\nThe vulnerability allows any authenticated user to systematically harvest sensitive account information for all registered users and retrieve arbitrary account profiles via direct endpoint queries.\nThe primary impact includes severe privacy loss, instance-wide user reconnaissance, exposure of administrative accounts, and facilitated targeted phishing campaigns.\nThe risk implications are high due to the exposure of personally identifiable information and internal organizational structure.\nAttacker capabilities are limited only to possessing valid user authentication credentials, requiring no elevated privileges to exploit the flawed endpoints.\nExploitation is trivial, requiring direct HTTP requests to specific API routes without triggering advanced attack complexities.",
  "technicalDetails": "The root cause of the vulnerability stems from inadequate access control implementation and a complete lack of response sanitization within the user management controllers.\nThe vulnerable components reside in the server/api/controllers/users/index.js file and the underlying routing policies configured in server/config/policies.js.\nSpecifically, the users/index and users/show actions rely solely on the default is-authenticated policy, failing to verify whether the requesting user possesses administrative privileges or a legitimate business need to access peer account details.\nThe controller executes sails.helpers.users.getMany() and directly returns the resulting dataset without filtering out sensitive attributes.\nAffected versions include all deployments of 4gaBoards prior to version 3.3.9.\nAuthentication requirements dictate that an attacker must be authenticated to the system, meaning any standard, low-privileged user account can initiate the attack.\nPrivilege requirements are minimal, as the default is-authenticated policy permits standard users to query endpoints intended for broader data retrieval.\nNetwork exposure is inherent to the web application's API architecture, accessible via standard HTTP/HTTPS protocols over the network.\nThe attack flow proceeds as follows: First, an attacker authenticates to the 4gaBoards instance using a standard user account. Second, the attacker issues a GET request to the /api/users endpoint. Third, the server processes the request via sails.helpers.users.getMany() and returns a comprehensive JSON payload containing records for all system users. Fourth, the attacker may iteratively issue GET requests to /api/users/:id to extract specific arbitrary accounts.\nThe resulting payload behavior exposes critical Personally Identifiable Information (PII) and sensitive metadata, including email addresses, phone numbers, organizational affiliations, full names, administrative status flags (isAdmin), and various single sign-on (SSO) linked email addresses such as ssoGoogleEmail and ssoGithubEmail.\nPost-exploitation impact involves extensive reconnaissance, mapping of administrative personnel, and harvesting credentials or communication vectors for sophisticated phishing attacks targeting the organization."
}