CVE-2026-53958

creationtimestamp| type| source ---|---|--- 2026-08-18 23:01:56+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mtfd4xzxxc2m...

CVE-2026-53958

4gaBoards versions prior to 3.3.9 are vulnerable to an SSO pre-account takeover via mass assignment. The whitelist in server/api/controllers/users/update.js permits an authenticated user to modify backend-managed identity fields (e.g., ssoGithubId, ssoGoogleId, ssoOidcId) through PATCH /api/users...