Authenticated Mass Information Disclosure on /api/users in Sails.js (CVE-2025-53959)

Vulnerability Overview Mass Information Disclosure (Internal PII Leakage) on /api/users to any authenticated user Vulnerability Type: Information Disclosure, Broken Access Control (CWE-200) Affected Versions: Tested on v3.3.8 (may affect all prior versions) Impact: High - Any registered user (including unverified accounts) can dump the information of all registered users in the database, including administrators. Scope of Impact Severity: 6.5 / 10 CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Confidentiality: High - Integrity: None - Availability: None CVE ID: CVE-2025-53959 Weakness: CWE-200 Remediation 1. Restrict /api/users to Administrators Only - Update the file to strictly enforce administrative privileges for listing all users: 2. Implement Owner/Administrator Verification in users/show.js - Ensure that regular users can only request their own profile data, while administrators retain the ability to view any profile: Proof of Concept (PoC) Code Step 1: Register a malicious account to obtain a valid session token Step 2: Dump the entire user database Output Result The API returns a JSON array containing the PII of all users, including administrators: Security Impact Massive PII Leakage: Attackers can easily scrape the names, private emails, and phone numbers of all employees/users on self-hosted 4gaBoards instances. Targeted Phishing: The leaked data provides a perfect reconnaissance basis for phishing campaigns targeting high-privilege users (administrators). Privacy Violation: This constitutes a severe data privacy breach, particularly for instances deployed in enterprise environments. Recommended Remediation 1. Limit Results to Shared Project Members Only - In : 2. Strip Sensitive Fields for Non-Admin Callers - Before returning the response: Video PoC PILeakage.4gaBoards.mp4 Summary Any registered user can enumerate all accounts on the instance, including email addresses and administrator status ( ), via . No privilege escalation is required. Detailed Information is protected only by the policy (any valid session token), with no owner or membership scoping. The response returns all user objects, including , , , and emails associated with all SSO connections. Relevant policy configuration ( ): PoC Steps 1. Register a standard test account 2. Obtain no direct access 3. Log into the admin account (for demonstration purposes) to view the current user, which facilitates subsequent validation. 4. The instance runs on , using default seed credentials. Log in as a regular user (e.g., ) and call the endpoint: Impact OWASP API3:2023 Excessive Data Exposure / API1:2023 Broken Object Level Authorization (BOLA): Any registered user can retrieve the email address and administrator status for every account in the instance, enabling targeted phishing against administrators and full user enumeration. Recommended Remediation 1. Limit results to shared project members only 2. Strip sensitive fields for non-admin callers Both changes are necessary: limiting scope still leaks the and email fields; stripping fields still exposes the complete user list.

Goal Reached Thanks to every supporter — we hit 100%!

Authenticated Mass Information Disclosure on /api/users in Sails.js (CVE-2025-53959)

More from this source