Raw vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2026-39912 is a critical-severity Insertion of Sensitive Information Into Sent Data (CWE-201) vulnerability in Chocapikk (inferred from references). Its CVSS base score is 9.1 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 44th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to AU-13 (Monitoring for Information Disclosure) and CM-7 (Least Functionality) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-39912 is a high-severity vulnerability (CVSS 3.1 score of 9.1) affecting V2Board versions 1.6.1 through 1.7.4 and Xboard versions through 0.1.9, stemming from CWE-201 (Exposure of Sensitive Information to an Unauthorized Actor). When the login_with_mail_link_enable feature is active, these applications expose authentication tokens directly in the HTTP response bodies of the loginWithMailLink endpoint. This flaw allows attackers to extract full authentication URLs containing tokens without prior authentication.
Unauthenticated remote attackers can exploit this vulnerability by sending a POST request to the loginWithMailLink endpoint using a known email address associated with any user account. The response provides the complete authentication URL with an embedded token, which the attacker can then submit to the token2Login endpoint. This exchanges the token for a valid bearer token, granting full account access, including administrative privileges if the targeted account has them.
Advisories and patch references, including a detailed analysis on chocapikk.com and GitHub sources for Xboard, point to mitigations via code fixes. A specific commit (121511523f04882ec0c7447acd9b8ebcb8a47957) and pull request (#873) in the Xboard repository address the token exposure in AuthController.php and MailLinkService.php. Security practitioners should update to patched versions where available, disable the login_with_mail_link_enable feature if not required, and review logs for suspicious POST requests to these endpoints.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-21043
Vulnerability Data
V2Board 1.6.1 through 1.7.4 and Xboard through 0.1.9 expose authentication tokens in HTTP response bodies of the loginWithMailLink endpoint when the login_with_mail_link_enable feature is active. Unauthenticated attackers can POST to the loginWithMailLink endpoint with a known email address to receive…
more
the full authentication URL in the response, then exchange the token at the token2Login endpoint to obtain a valid bearer token with complete account access including admin privileges.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability allows unauthenticated remote exploitation of a public-facing web application (loginWithMailLink endpoint) to leak and obtain valid authentication tokens, directly enabling T1190 for initial access and T1078 for abusing valid accounts to gain full access including admin privileges.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Remediating the code flaw in AuthController.php and MailLinkService.php that exposes authentication tokens in loginWithMailLink responses directly prevents exploitation and unauthorized account access.
Disabling the unnecessary login_with_mail_link_enable feature prohibits the vulnerable endpoint from exposing tokens to unauthenticated attackers.
Monitoring HTTP responses from the loginWithMailLink endpoint for unauthorized disclosure of authentication tokens identifies exploitation attempts in progress.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly prevent insertion of sensitive data into application outputs and messages.
Monitoring runtime data flows and outputs can detect sensitive data being transmitted.
Protecting data-in-transit can include filtering or encrypting to avoid exposing sensitive content.
Protecting data-in-use includes removing confidential values before they are processed or sent.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Data-masking techniques can prevent sensitive values from appearing in transmitted payloads.
Classification identifies sensitive data so it is not inadvertently transmitted.
Labelling makes sensitive data visible to developers and prevents accidental inclusion in outbound messages.
Information-transfer rules directly govern what data may be sent to external parties.
PII-protection requirements reduce the chance of sending personal data to unauthorized recipients.
DLP controls inspect and block outbound flows that contain sensitive information.