RARgames 4gaBoards up to 3.3.7 SSO Integration get-create-one-for-github-sso.js email permission

Summaryinfo

A vulnerability was found in RARgames 4gaBoards up to 3.3.7. It has been rated as critical. Affected by this issue is some unknown functionality of the file server/api/helpers/users/get-create-one-for-github-sso.js of the component SSO Integration. The manipulation of the argument email leads to permission. This vulnerability is listed as CVE-2026-50191. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability was found in RARgames 4gaBoards up to 3.3.7 and classified as critical. This issue affects an unknown function of the file server/api/helpers/users/get-create-one-for-github-sso.js of the component SSO Integration. The manipulation of the argument email with an unknown input leads to a permission vulnerability. Using CWE to declare the problem leads to CWE-275. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

4gaBoards is a boards system for realtime project management. Prior to 3.3.8, 4gaBoards is vulnerable to pre-account takeover when registrationEnabled, localRegistrationEnabled, and ssoRegistrationEnabled are enabled and Google, GitHub, Microsoft, or OIDC SSO is configured. The POST /api/register endpoint permits creation of an unverified local account with a victim's email address, and POST /api/access-tokens permits that account to authenticate while isVerified is false. During the victim's first SSO login, server/api/helpers/users/get-create-one-for-github-sso.js, server/api/helpers/users/get-create-one-for-google-sso.js, server/api/helpers/users/get-create-one-for-microsoft-sso.js, and server/api/helpers/users/get-create-one-for-oidc-sso.js find the attacker-controlled account by email and link the verified SSO identity without confirming ownership of the local account. The attacker can retain local-password access to the linked account and obtain the victim's projects, data, and permissions. This issue is fixed in version 3.3.8.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-50191 since 06/04/2026. The exploitation is known to be easy. The attack may be initiated remotely. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1222 according to MITRE ATT&CK.

Upgrading to version 3.3.8 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Forum Software

Vendor

• RARgames

Name

• 4gaBoards

Version

• 3.3.0
• 3.3.1
• 3.3.2
• 3.3.3
• 3.3.4
• 3.3.5
• 3.3.6
• 3.3.7

Website

• Product: https://github.com/RARgames/4gaBoards/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion