The flaw allows an attacker to create an unverified local account using a victim's email address when registrationEnabled, localRegistrationEnabled, and ssoRegistrationEnabled are all active and at least one of the supported SSO providers (Google, GitHub, Microsoft or OIDC) is configured. The attacker then links a verified SSO identity to that account without confirming ownership, thereby gaining full access to the victim’s data and project permissions. This constitutes an authentication bypass (CWE-287) and an improper privilege escalation (CWE-288), with a CVSS score of 8.8.

The issue affects the open‑source boards application RARgames:4gaBoards, specifically any deployment of versions earlier than 3.3.8 where registrationEnabled, localRegistrationEnabled, and ssoRegistrationEnabled are all active and at least one of Google, GitHub, Microsoft, or OIDC SSO providers is configured. The vulnerability is mitigated in version 3.3.8 released in the Jan 2026 snapshot.

An attacker can trigger the vulnerability by sending HTTP requests to the publicly accessible POST /api/register and POST /api/access-tokens endpoints, creating an account with a victim’s email that is not verified. The system then authenticates this account during the victim’s first SSO login, finds the attacker‑controlled account by email, and automatically links the SSO identity without validating ownership. The attacker thereby obtains both local and SSO credentials and full access to the victim’s projects. The CVSS score of 8.8 indicates high‑severity impact, and although the EPSS score is not available and the vulnerability is not listed in CISA KEV, the remote attack vector and lack of verification make exploitation readily possible without additional prerequisites.