4gaBoards versions before 3.3.9 have a vulnerability where authenticated users can modify SSO identity attributes (such as ssoGoogleId, ssoGithubId, ssoMicrosoftId, ssoOidcId, and associated emails) through the PATCH /api/users/:id endpoint. The server-side whitelist improperly mass assigns these backend-managed attributes from user input. An attacker can exploit this by assigning a victim's SSO provider identifier to an attacker-controlled account. When the victim logs in via SSO, the system matches the victim's login to the attacker's account before the email-linkage flow executes, resulting in the victim being logged into the attacker's account. This leads to unauthorized access to the victim's projects, boards, and data through the attacker's credentials. The vulnerability is addressed in 4gaBoards version 3.3.9.

An attacker can cause a victim to be logged into the attacker's account during their first SSO login, leading to unauthorized access to the victim's projects, boards, and data. This compromises confidentiality and integrity of user data with high impact on confidentiality and integrity and low impact on availability. The CVSS v3.1 score is 7.6 (high severity) with network attack vector, low attack complexity, requiring privileges and user interaction, and resulting in high confidentiality and integrity impact.

This vulnerability is fixed in 4gaBoards version 3.3.9. Users should upgrade to version 3.3.9 or later to remediate this issue. No official patch link is provided in the data, so verify the fix availability from the vendor's official channels. Since this is not a cloud service, remediation depends on user upgrade. Patch status is not explicitly confirmed beyond the fix version statement; check vendor advisory for current remediation guidance.