4gaBoards versions before 3.3.9 contain an improper authentication vulnerability (CWE-287) where the server-side whitelist for user identity attributes in the PATCH /api/users/:id endpoint improperly allows modification of SSO-related fields such as ssoGoogleId, ssoGithubId, and others. This mass assignment flaw lets an attacker bind a victim's SSO provider identifier to the attacker's account. Consequently, when the victim logs in via SSO, they are authenticated into the attacker's account, granting the attacker access to any projects or data the victim creates. The issue is resolved in 4gaBoards version 3.3.9.

An attacker can cause a victim to be logged into the attacker's account by manipulating SSO identity attributes. This leads to unauthorized access to the victim's projects, boards, and data through the attacker's credentials. The vulnerability compromises confidentiality and integrity of user data with high impact on confidentiality and integrity, and low impact on availability.

Upgrade 4gaBoards to version 3.3.9 or later, where this improper authentication vulnerability is fixed. No other mitigation is required as the fix addresses the root cause.