4gaBoards, a real‑time project management board system, allows any authenticated user to retrieve complete account information for every user via GET /api/users and GET /api/users/:id. The application fails to apply requester‑specific authorization or response sanitization, returning PII such as email, phone, organization, name and SSO-linked email fields, even for administrators. This results in instance‑wide user enumeration, privacy loss, and opens the door to targeted phishing or social engineering attacks.

The vulnerability affects RARgames' 4gaBoards in all releases prior to 3.3.9. Versions 3.3.9 and later contain the fix that restricts returned data and enforces proper access control.

The CVSS score is 6.5, indicating moderate severity. EPSS data is not available, and the issue is not listed in CISA KEV. Attackers who are authenticated users can exploit this flaw directly without additional privileges, as the default authentication policy allows enumeration of all user records. The exploit does not require external access; it can be carried out internally once a valid user session exists.