4gaBoards versions before 3.3.9 have an information exposure vulnerability (CWE-200) where authenticated users can access the GET /api/users and GET /api/users/:id endpoints without requester-specific authorization or response sanitization. The users/index and users/show actions rely solely on a default is-authenticated policy, allowing enumeration of all user accounts and exposure of sensitive fields such as email, phone, organization, admin status, and multiple SSO-linked email addresses. This results in instance-wide user enumeration and privacy loss. The issue is resolved in version 3.3.9.

The vulnerability allows any authenticated user to access sensitive personal and administrative information of all users on the 4gaBoards instance. This exposure can lead to privacy violations and enable attackers or malicious insiders to conduct targeted phishing or social engineering attacks. There is no indication of impact on integrity or availability.

Upgrade 4gaBoards to version 3.3.9 or later, where this vulnerability is fixed. The fix includes proper authorization checks and response sanitization on the affected API endpoints. No other mitigation is indicated.