CVE-2026-53959

creationtimestamp| type| source ---|---|--- 2026-08-20 03:00:03+00:00| published-proof-of-concept| Telegram/OaQKbbdvw00bB0UsV4uIS74p-Dstov7w7gsjctrALY9lZiQ 2026-08-20 03:00:04+00:00| published-proof-of-concept| Telegram/70I5ZXCQ9tuhykRUfpeQOhK2E7uKn9kN9IGVXWKzWNyM 2026-08-21 00:00:12+00:00|...

Exploit for CVE-2026-53959

CVE-2026-53959 - 4gaBoards python exploit.py http://localhost...

CVE-2026-53959 4gaBoards: Mass Information Disclosure (Internal PII Leakage) on /api/users to any authenticated user

4gaBoards is a boards system for realtime project management. Prior to 3.3.9, 4gaBoards allows any authenticated user to enumerate account information for every user through GET /api/users and retrieve arbitrary accounts through GET /api/users/:id. The users/index and users/show actions rely only...

CVE-2026-53959

In 4gaBoards prior to 3.3.9, authenticated users can call GET /api/users or GET /api/users/:id to retrieve every account's email, phone, organization, SSO-linked email fields, and isAdmin flag for any user including administrators. The root cause is that server/api/controllers/users/index.js retu...