CVE-2026-37504
V2Board ≤ 1.7.4
Raw vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:NSummary
CVE-2026-37504 is a medium-severity Use of HTTP Request With Sensitive Query String (CWE-598) vulnerability in V2Board V2Board. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Steal Application Access Token (T1528); ranked at the 21th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SC-8 (Transmission Confidentiality and Integrity) and AC-17 (Remote Access) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-26668
Vulnerability Data
Sensitive server_token exposed via GET parameter in V2Board thru 1.7.4. In app/Http/Controllers/Server/UniProxyController.php, the server authentication token is accepted via GET parameter transmission. The token appears in URLs such as /api/v1/server/UniProxy/user?token=SECRET, causing it to be recorded in web server access logs,…
more
browser history, HTTP Referer headers, and proxy/CDN logs. An attacker who gains access to any log source can extract the token and impersonate a proxy server node, potentially intercepting all user traffic.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Token exposure in GET params/logs directly enables stealing application access tokens (T1528) and unsecured credentials from files (T1552.001).
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Requires cryptographic protection of sensitive data (the server_token) in transit, directly precluding its placement in observable GET query strings.
Enforces information-flow policies that prohibit embedding authentication tokens in URLs where they can be captured by logs, referrers, or proxies.
Mandates secure remote-access mechanisms for management and proxy APIs, eliminating the use of GET-based token transmission.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly prevent embedding sensitive data in query strings as part of input-handling and data-flow design.
HTTPS encryption protects query strings in transit but does not address the root design flaw of placing sensitive data in URLs.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect sensitive data leakage via query strings.
DLP solutions can detect and block sensitive data in URLs.
Network security controls can enforce HTTPS and block sensitive data in URLs.
Application security requirements should mandate avoiding sensitive data in query strings.
Secure architecture principles discourage exposing sensitive data in URLs.
Secure coding standards directly prohibit placing secrets in query parameters.