4gaBoards versions before 3.3.9 allow authenticated users to access the GET /api/users and GET /api/users/:id endpoints without proper authorization checks or response sanitization. The users/index and users/show actions rely solely on a default is-authenticated policy, which does not restrict access to user data based on requester identity. As a result, sensitive information such as email addresses, phone numbers, organization names, admin flags, and SSO-linked emails are exposed for all users, including administrators. This leads to instance-wide user enumeration and privacy loss, facilitating targeted phishing reconnaissance. The vulnerability is addressed by fixing authorization and sanitization in version 3.3.9.

The vulnerability allows any authenticated user to enumerate all user accounts and access sensitive personal and administrative information, including emails and phone numbers. This exposure can lead to privacy violations and enable attackers to conduct targeted phishing attacks against users and administrators. There is no indication of impact on integrity or availability. No known exploits in the wild have been reported.

This vulnerability is fixed in 4gaBoards version 3.3.9. Users and administrators should upgrade to version 3.3.9 or later to remediate the issue. Since no official patch link or advisory is provided, verify the upgrade from the vendor's official release notes or repository. Until upgraded, restrict authenticated user access to the affected API endpoints if possible.