Which versions of V2Board are affected by CVE-2026-39912?

V2Board and Xboard installations are vulnerable to unauthenticated account takeover affecting all user accounts including administrators through a compromised email-based authentication mechanism.. A patch is available.

Is there a public PoC exploit available for CVE-2026-39912?

Yes, a public proof-of-concept exploit is available for CVE-2026-39912. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-39912?

Within 24 hours: Identify all V2Board and Xboard instances in production and verify affected versions. Within 7 days: Apply vendor-released patch to V2Board ≥1.7.5 and Xboard ≥0.2.0, or immediately disable the login_with_mail_link_enable feature if patching cannot be completed. Within 30 days: Conduct account audit for unauthorized access, reset all admin credentials, review authentication logs for exploitation attempts, and implement network-level controls restricting loginWithMailLink endpoint access to authorized users only.

V2Board CVE-2026-39912

Q: What is the CVSS score of CVE-2026-39912?

CVE-2026-39912 has a CVSS 4.0 base score of 9.1 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-21043 CRITICAL

Insertion of Sensitive Information Into Sent Data (CWE-201)

2026-04-09 VulnCheck

GHSA-83h9-46h8-whf4

Information Disclosure Microsoft V2Board Xboard

9.1

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.1 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulnCheck) · only source for this CVE.

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Apr 09, 2026 - 19:16 vuln.today

Public exploit code

EUVD ID Assigned

Apr 09, 2026 - 19:15 euvd

EUVD-2026-21043

Analysis Generated

Apr 09, 2026 - 19:15 vuln.today

Patch released

Apr 09, 2026 - 19:15 nvd

Patch available

CVE Published

Apr 09, 2026 - 18:35 nvd

CRITICAL 9.1

DescriptionCVE.org

V2Board 1.6.1 through 1.7.4 and Xboard through 0.1.9 expose authentication tokens in HTTP response bodies of the loginWithMailLink endpoint when the login_with_mail_link_enable feature is active. Unauthenticated attackers can POST to the loginWithMailLink endpoint with a known email address to receive the full authentication URL in the response, then exchange the token at the token2Login endpoint to obtain a valid bearer token with complete account access including admin privileges.

Articles & Coverage 1

POC POC: Xboard / V2Board Unauth Account Takeover - Magic Link Token Leak (CVE-2026-39912) Apr 09, 2026

AnalysisAI

Authentication bypass in V2Board 1.6.1-1.7.4 and Xboard ≤0.1.9 enables unauthenticated account takeover including admin privileges. When login_with_mail_link_enable is active, attackers POST known email addresses to the loginWithMailLink endpoint, receiving full authentication URLs in HTTP responses. Tokens extracted from these URLs are exchanged at token2Login for valid bearer tokens granting complete account access. Publicly available exploit code exists. CVSS 9.1 critical severity reflects network-accessible attack with no user interaction required.

Technical ContextAI

CWE-201 information exposure via authentication token leakage in response bodies. AuthController.php and MailLinkService.php return sensitive tokens directly in loginWithMailLink responses instead of transmitting via secure email channels. PR:N confirms unauthenticated exploitation; attackers enumerate valid emails and extract tokens from JSON responses without SMTP interception.

RemediationAI

Vendor-released patches: Upgrade V2Board to version addressing GitHub PR #981 or apply commit fixes from upstream repository. Upgrade Xboard to commit 121511523f04882ec0c7447acd9b8ebcb8a47957 or later patched release incorporating PR #873. If immediate upgrade is impossible, disable login_with_mail_link_enable feature in application configuration to eliminate the attack vector. Rotate all existing authentication tokens and audit access logs for unauthorized sessions created via loginWithMailLink or token2Login endpoints. Review VulnCheck advisory for additional mitigation guidance: https://www.vulncheck.com/advisories/v2board-xboard-authentication-token-exposure-via-loginwithmaillink. Validate patch deployment by confirming tokens no longer appear in loginWithMailLink HTTP responses.