Raw vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-39912 is a critical-severity Insertion of Sensitive Information Into Sent Data (CWE-201) vulnerability in Chocapikk (inferred from references). Its CVSS base score is 9.1 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Network Sniffing (T1040); ranked at the 46th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-4 (Information Flow Enforcement) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-39912 is a high-severity vulnerability (CVSS 3.1 score of 9.1) affecting V2Board versions 1.6.1 through 1.7.4 and Xboard versions through 0.1.9, stemming from CWE-201 (Exposure of Sensitive Information to an Unauthorized Actor). When the login_with_mail_link_enable feature is active, these applications expose authentication tokens directly in the HTTP response bodies of the loginWithMailLink endpoint. This flaw allows attackers to extract full authentication URLs containing tokens without prior authentication.
Unauthenticated remote attackers can exploit this vulnerability by sending a POST request to the loginWithMailLink endpoint using a known email address associated with any user account. The response provides the complete authentication URL with an embedded token, which the attacker can then submit to the token2Login endpoint. This exchanges the token for a valid bearer token, granting full account access, including administrative privileges if the targeted account has them.
Advisories and patch references, including a detailed analysis on chocapikk.com and GitHub sources for Xboard, point to mitigations via code fixes. A specific commit (121511523f04882ec0c7447acd9b8ebcb8a47957) and pull request (#873) in the Xboard repository address the token exposure in AuthController.php and MailLinkService.php. Security practitioners should update to patched versions where available, disable the login_with_mail_link_enable feature if not required, and review logs for suspicious POST requests to these endpoints.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-21043
Vulnerability Data
V2Board 1.6.1 through 1.7.4 and Xboard through 0.1.9 expose authentication tokens in HTTP response bodies of the loginWithMailLink endpoint when the login_with_mail_link_enable feature is active. Unauthenticated attackers can POST to the loginWithMailLink endpoint with a known email address to receive…
more
the full authentication URL in the response, then exchange the token at the token2Login endpoint to obtain a valid bearer token with complete account access including admin privileges.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 1 hardening rule · 1 OS baseline
V14.2.3
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces policy-based information flow rules that block transmission of sensitive data to unauthorized actors.
Enforces authorizations on logical access so that sensitive data is not released to unauthorized recipients.
Requires validation of outbound information to ensure sensitive content is not disclosed in responses or messages.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Monitoring runtime data flows and outputs can detect sensitive data being transmitted.
Protecting data-in-transit can include filtering or encrypting to avoid exposing sensitive content.
Protecting data-in-use includes removing confidential values before they are processed or sent.
Secure SDLC practices directly prevent insertion of sensitive data into application outputs and messages.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Classification identifies sensitive data so it is not inadvertently transmitted.
Labelling makes sensitive data visible to developers and prevents accidental inclusion in outbound messages.
Information-transfer rules directly govern what data may be sent to external parties.
PII-protection requirements reduce the chance of sending personal data to unauthorized recipients.
Data-masking techniques can prevent sensitive values from appearing in transmitted payloads.
DLP controls inspect and block outbound flows that contain sensitive information.