This module exploits a broken access control vulnerability in 4gaBoards versions 3.3.8 or less. The /api/users endpoint allows any authenticated user to enumerate account information for every user. Responses expose email, phone, organization, name, isAdmin, ssoGoogleEmail, ssoGithubEmail, and other SSO-linked email fields.
The module first creates a new user with the supplied email to obtain an access token. The access token is then used to dump information of all users registered on the application. If valid administrator credentials are provided, the module also performs cleanup by deleting the newly created user account.
To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':
msf > use auxiliary/gather/4gaboards/users_info_disclosure_cve_2026_53959msf undefined(users_info_disclosure_cve_2026_53959) > show actions ...actions...msf undefined(users_info_disclosure_cve_2026_53959) > set ACTION < action-name >msf undefined(users_info_disclosure_cve_2026_53959) > show options ...show and set options...msf undefined(users_info_disclosure_cve_2026_53959) > runWith curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub