Skip to content
OpenAdvisories

Vendor

RARgames

6 known vulnerabilities.

RARgames at a glance

Last 12 months
6
Critical · all time
0
Exploited · all time
0
Public exploit · all time
1
New vulnerabilities per month · last 12 months
0 3 5 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 2 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 4 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202600
Aug 202640
Jul 202600
Jun 202600
May 202600
Apr 202620
Mar 202600
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

4gaBoards 6
All Critical High Medium Low Exploited only Public exploit

6 results · Feed

  • Medium 6.5
    CVE-2026-53959 Public exploit

    4gaBoards: Mass Information Disclosure (Internal PII Leakage) on /api/users to any authenticated user

    4gaBoards is a boards system for realtime project management. Prior to 3.3.9, 4gaBoards allows any authenticated user to enumerate account information for every user through GET /api/users and retrieve arbitrary accounts through GET /api/users/:id. The users/…

    RARgames 4gaBoards
  • High 7.6
    CVE-2026-53958

    4gaBoards: SSO Pre-Account Takeover / Hijacking via Mass Assignment

    4gaBoards is a boards system for realtime project management. Prior to 3.3.9, 4gaBoards allows an authenticated user to modify ssoGoogleId, ssoGoogleEmail, ssoGithubId, ssoGithubUsername, ssoGithubEmail, ssoMicrosoftId, ssoMicrosoftEmail, ssoOidcId, and ssoOi…

    RARgames 4gaBoards
  • High 8.8
    CVE-2026-50186

    4gaBoards: Path Traversal leading to Arbitrary File Read and Deletion in Board Export

    4gaBoards is a boards system for realtime project management. Prior to 3.3.8, 4gaBoards allows an authenticated project manager to supply traversal sequences in the filename parameter of GET /exports/:id/:filename. In server/api/controllers/boards/download.js…

    RARgames 4gaBoards
  • High 8.8
    CVE-2026-50191

    4gaBoards: Pre-Account Takeover via SSO Email Linkage

    4gaBoards is a boards system for realtime project management. Prior to 3.3.8, 4gaBoards is vulnerable to pre-account takeover when registrationEnabled, localRegistrationEnabled, and ssoRegistrationEnabled are enabled and Google, GitHub, Microsoft, or OIDC SSO…

    RARgames 4gaBoards
  • High 7.6
    CVE-2026-41419

    4ga Boards: Import Path Traversal Leads to Arbitrary File Read

    4ga Boards is a boards system for realtime project management. Prior to 3.3.5, a path traversal vulnerability allows an authenticated user with board import privileges to make the server ingest arbitrary host files as board attachments during BOARDS archive i…

    RARgames 4gaBoards
  • Medium 5.3
    CVE-2026-41418

    4ga Boards: User Enumeration via Timing Side-Channel in Authentication Endpoint

    4ga Boards is a boards system for realtime project management. Prior to 3.3.5, 4ga Boards is vulnerable to user enumeration via a timing side-channel in the login endpoint (POST /api/access-tokens). When an invalid username/email is provided, the server respo…

    RARgames 4gaBoards