RARgames CVE debriefs

CVE-2026-53959

The 4gaBoards system for realtime project management, prior to version 3.3.9, allows any authenticated user to enumerate account information for every user through GET /api/users and retrieve arbitrary accounts through GET /api/users/:id. The vulnerability exists due to insufficient authorization and response sanitization in the users/index and users/show actions. This enables instance-wide user enumerati [truncated]