CVE-2026-53959 4gaBoards: Mass Information Disclosure (Internal PII Leakage) on /api/users to any authenticated user

4gaBoards is a boards system for realtime project management. Prior to 3.3.9, 4gaBoards allows any authenticated user to enumerate account information for every user through GET /api/users and retrieve arbitrary accounts through GET /api/users/:id. The users/index and users/show actions rely only...

CVE-2026-53959

In 4gaBoards prior to 3.3.9, authenticated users can call GET /api/users or GET /api/users/:id to retrieve every account's email, phone, organization, SSO-linked email fields, and isAdmin flag for any user including administrators. The root cause is that server/api/controllers/users/index.js retu...