4gaBoards allows an authenticated user to modify SSO identity attributes through the PATCH /api/users/:id endpoint without proper authorization checks. This mass assignment flaw lets an attacker place a victim’s provider identifier on an attacker‑controlled account, causing the system’s default lookup to bind the victim’s first SSO login to the attacker’s account before the normal email‑linkage process runs. As a result the victim is inadvertently logged into the attacker’s account and any projects or data the victim creates remain accessible via the attacker’s credentials. The weakness is captured by CWE‑287 and CWE‑915.

The vulnerability affects the RARgames 4gaBoards application, versions prior to 3.3.9. The official fix is included in release 3.3.9, which removes the mass assignment of the listed SSO attributes.

The CVSS score of 7.6 places this issue in the high‑severity range, while the EPSS score is unavailable and it is not listed in the CISA KEV catalog. Exploitation requires an authenticated user to send a crafted PATCH request to another user’s endpoint; no special local privilege or network restrictions are mentioned, implying a remote attack vector once a user is logged in. Because the flaw directly enables a pre‑account takeover, the likelihood of impact is significant, especially in environments where users have unrestricted access to the full update endpoint.