4gaBoards CVE-2026-53958

The attacker must hold a valid authenticated 4gaBoards account (PR:L confirmed by CVSS vector). The victim must use an SSO provider login - Google, GitHub, Microsoft, or OIDC - rather than local credentials for their next authentication attempt (UI:R confirmed by CVSS vector; exploitation cannot occur if the victim only ever uses local password login). The attacker must possess a valid SSO provider identifier for the target user - specifically, a provider-issued subject ID or email address corresponding to one of the configured SSO providers; this may require reconnaissance via public APIs (e.g., GitHub's user API) or social engineering. At least one SSO provider must be enabled and configured in the 4gaBoards deployment - the vulnerability has no impact in local-credentials-only deployments. Exploitation is further constrained to cases where the attacker plants the identifier before the victim's next SSO login, introducing a timing window.

The CVSS 7.6 High score (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L) is well-calibrated for this vulnerability. The network vector and low complexity are accurate - exploiting the flaw requires only a standard authenticated HTTP PATCH request. The PR:L designation correctly reflects that a low-privileged account is sufficient; no administrative access is needed. The UI:R flag is the key limiting factor: the victim must independently attempt an SSO login after the attacker has planted their provider identifier, introducing a timing dependency. EPSS data is not available in the provided intelligence, so exploitation probability cannot be quantified probabilistically. The vulnerability is not listed in CISA KEV and no POC has been publicly confirmed. Despite the absence of known active exploitation, the attack chain is simple enough that even a mid-sized municipal IT team in walbrzych running 4gaBoards with SSO enabled should treat this as urgent patching priority, since successful exploitation fully exposes victim project data and persists even after the victim logs out. The low A:L impact reflects that only the victim's access continuity is disrupted, not service availability. Overall, this is a genuine high-risk issue - not a high-CVSS-but-low-real-risk case - for any deployment with SSO enabled.

An attacker with a valid 4gaBoards account sends an authenticated PATCH /api/users/:id request against their own user record, supplying the target victim's GitHub numeric user ID in the ssoGithubId field - information potentially obtainable via the GitHub public API given the victim's username. When the victim next authenticates to 4gaBoards using GitHub SSO, the get-create-one-for-github-sso.js helper matches the incoming GitHub ID to the attacker's account and establishes the victim's session there. The attacker then logs in with their original local password and browses all projects and boards the victim has since created or been added to, with no further victim interaction required.