CVE-2026-50191 describes an improper authentication vulnerability (CWE-287) in 4gaBoards before version 3.3.8. When registrationEnabled, localRegistrationEnabled, and ssoRegistrationEnabled are all enabled alongside configured SSO providers (Google, GitHub, Microsoft, or OIDC), the /api/register endpoint allows creation of unverified local accounts with arbitrary victim email addresses. The /api/access-tokens endpoint permits authentication of these unverified accounts. During the victim's first SSO login, the system links the attacker-controlled local account to the verified SSO identity by matching email without verifying ownership, allowing the attacker to retain local password access and access the victim's projects, data, and permissions. This vulnerability is fixed in version 3.3.8.

Successful exploitation allows an attacker to take over a victim's account by creating an unverified local account with the victim's email and linking it to the victim's verified SSO login. This results in unauthorized access to the victim's projects, data, and permissions, potentially leading to data compromise and loss of confidentiality, integrity, and availability.

Upgrade 4gaBoards to version 3.3.8 or later, where this vulnerability is fixed. Prior to upgrading, consider disabling registrationEnabled, localRegistrationEnabled, or ssoRegistrationEnabled features to reduce exposure. No other specific mitigations are documented. Patch status is confirmed fixed in 3.3.8.