CVE-2026-53958

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-53958", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-11T15:50:01.282Z", "datePublished": "2026-08-18T21:34:59.454Z", "dateUpdated": "2026-08-19T16:12:54.624Z"}, "containers": {"cna": {"title": "4gaBoards: SSO Pre-Account Takeover / Hijacking via Mass Assignment", "problemTypes": [{"descriptions": [{"cweId": "CWE-287", "lang": "en", "description": "CWE-287: Improper Authentication", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-915", "lang": "en", "description": "CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/RARgames/4gaBoards/security/advisories/GHSA-j2fw-r2gj-hfr3", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/RARgames/4gaBoards/security/advisories/GHSA-j2fw-r2gj-hfr3"}, {"name": "https://github.com/RARgames/4gaBoards/commit/7a79f4c5d338614058515752abd67e49ee2818bb", "tags": ["x_refsource_MISC"], "url": "https://github.com/RARgames/4gaBoards/commit/7a79f4c5d338614058515752abd67e49ee2818bb"}, {"name": "https://github.com/RARgames/4gaBoards/releases/tag/v3.3.9", "tags": ["x_refsource_MISC"], "url": "https://github.com/RARgames/4gaBoards/releases/tag/v3.3.9"}], "affected": [{"vendor": "RARgames", "product": "4gaBoards", "versions": [{"version": "< 3.3.9", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-18T21:34:59.454Z"}, "descriptions": [{"lang": "en", "value": "4gaBoards is a boards system for realtime project management. Prior to 3.3.9, 4gaBoards allows an authenticated user to modify ssoGoogleId, ssoGoogleEmail, ssoGithubId, ssoGithubUsername, ssoGithubEmail, ssoMicrosoftId, ssoMicrosoftEmail, ssoOidcId, and ssoOidcEmail through PATCH /api/users/:id. The whitelist in server/api/controllers/users/update.js mass assigns these backend-managed identity attributes from user input. An attacker can place a victim's provider identifier on an attacker-controlled account, causing the default lookup in helpers such as server/api/helpers/users/get-create-one-for-github-sso.js to match the victim's first SSO login to the attacker's account before the email-linkage flow runs. The victim is logged into the attacker-controlled account, and projects, boards, or data the victim creates remain accessible through the attacker's original local credentials. This issue is fixed in version 3.3.9."}], "source": {"advisory": "GHSA-j2fw-r2gj-hfr3", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/RARgames/4gaBoards/security/advisories/GHSA-j2fw-r2gj-hfr3", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-19T16:11:43.992653Z", "id": "CVE-2026-53958", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-19T16:12:54.624Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-53958", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-19T16:11:43.992653Z"}}}], "references": [{"url": "https://github.com/RARgames/4gaBoards/security/advisories/GHSA-j2fw-r2gj-hfr3", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-19T16:12:04.548Z"}}], "cna": {"title": "4gaBoards: SSO Pre-Account Takeover / Hijacking via Mass Assignment", "source": {"advisory": "GHSA-j2fw-r2gj-hfr3", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "RARgames", "product": "4gaBoards", "versions": [{"status": "affected", "version": "< 3.3.9"}]}], "references": [{"url": "https://github.com/RARgames/4gaBoards/security/advisories/GHSA-j2fw-r2gj-hfr3", "name": "https://github.com/RARgames/4gaBoards/security/advisories/GHSA-j2fw-r2gj-hfr3", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/RARgames/4gaBoards/commit/7a79f4c5d338614058515752abd67e49ee2818bb", "name": "https://github.com/RARgames/4gaBoards/commit/7a79f4c5d338614058515752abd67e49ee2818bb", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/RARgames/4gaBoards/releases/tag/v3.3.9", "name": "https://github.com/RARgames/4gaBoards/releases/tag/v3.3.9", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "4gaBoards is a boards system for realtime project management. Prior to 3.3.9, 4gaBoards allows an authenticated user to modify ssoGoogleId, ssoGoogleEmail, ssoGithubId, ssoGithubUsername, ssoGithubEmail, ssoMicrosoftId, ssoMicrosoftEmail, ssoOidcId, and ssoOidcEmail through PATCH /api/users/:id. The whitelist in server/api/controllers/users/update.js mass assigns these backend-managed identity attributes from user input. An attacker can place a victim's provider identifier on an attacker-controlled account, causing the default lookup in helpers such as server/api/helpers/users/get-create-one-for-github-sso.js to match the victim's first SSO login to the attacker's account before the email-linkage flow runs. The victim is logged into the attacker-controlled account, and projects, boards, or data the victim creates remain accessible through the attacker's original local credentials. This issue is fixed in version 3.3.9."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287: Improper Authentication"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-915", "description": "CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-18T21:34:59.454Z"}}}, "cveMetadata": {"cveId": "CVE-2026-53958", "state": "PUBLISHED", "dateUpdated": "2026-08-19T16:12:54.624Z", "dateReserved": "2026-06-11T15:50:01.282Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-18T21:34:59.454Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "4gaBoards", "vendor": "RARgames", "versions": [{"status": "affected", "version": "< 3.3.9"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "4gaBoards is a boards system for realtime project management. Prior to 3.3.9, 4gaBoards allows an authenticated user to modify ssoGoogleId, ssoGoogleEmail, ssoGithubId, ssoGithubUsername, ssoGithubEmail, ssoMicrosoftId, ssoMicrosoftEmail, ssoOidcId, and ssoOidcEmail through PATCH /api/users/:id. The whitelist in server/api/controllers/users/update.js mass assigns these backend-managed identity attributes from user input. An attacker can place a victim's provider identifier on an attacker-controlled account, causing the default lookup in helpers such as server/api/helpers/users/get-create-one-for-github-sso.js to match the victim's first SSO login to the attacker's account before the email-linkage flow runs. The victim is logged into the attacker-controlled account, and projects, boards, or data the victim creates remain accessible through the attacker's original local credentials. This issue is fixed in version 3.3.9."}, {"lang": "es", "value": "4gaBoards es un sistema de tableros para la gesti\u00f3n de proyectos en tiempo real. Antes de la versi\u00f3n 3.3.9, 4gaBoards permite a un usuario autenticado modificar ssoGoogleId, ssoGoogleEmail, ssoGithubId, ssoGithubUsername, ssoGithubEmail, ssoMicrosoftId, ssoMicrosoftEmail, ssoOidcId y ssoOidcEmail a trav\u00e9s de PATCH /API/users/:id. La lista blanca en server/api/controllers/users/update.js asigna masivamente estos atributos de identidad gestionados por el backend a partir de la entrada del usuario. Un atacante puede colocar el identificador de proveedor de una v\u00edctima en una cuenta controlada por el atacante, lo que hace que la b\u00fasqueda predeterminada en ayudantes como server/api/helpers/users/get-create-one-for-github-sso.js coincida con el primer inicio de sesi\u00f3n SSO de la v\u00edctima con la cuenta del atacante antes de que se ejecute el flujo de vinculaci\u00f3n por correo electr\u00f3nico. La v\u00edctima inicia sesi\u00f3n en la cuenta controlada por el atacante, y los proyectos, tableros o datos que la v\u00edctima crea permanecen accesibles a trav\u00e9s de las credenciales locales originales del atacante. Este problema se soluciona en la versi\u00f3n 3.3.9."}], "id": "CVE-2026-53958", "lastModified": "2026-10-22T17:09:59.477", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 5.5, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-53958", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-19T16:11:43.992653Z", "version": "2.0.3"}}]}, "published": "2026-08-18T22:16:54.717", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/RARgames/4gaBoards/commit/7a79f4c5d338614058515752abd67e49ee2818bb"}, {"source": "security-advisories@github.com", "url": "https://github.com/RARgames/4gaBoards/releases/tag/v3.3.9"}, {"source": "security-advisories@github.com", "url": "https://github.com/RARgames/4gaBoards/security/advisories/GHSA-j2fw-r2gj-hfr3"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/RARgames/4gaBoards/security/advisories/GHSA-j2fw-r2gj-hfr3"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}, {"lang": "en", "value": "CWE-915"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.3.9)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "4gaBoards", "source": "cna", "vendor": "RARgames"}, "product": "4gaboards", "vendor": "rargames"}], "created": "2026-08-18T22:45:02.975952+00:00", "updated": "2026-08-19T09:15:12.606869+00:00", "vendors": ["rargames", "rargames$PRODUCT$4gaboards"]}