PT-2026-36485 · V2Board · V2Board

Sginnora · Published 2026-05-01 · Updated 2026-05-11 · CVE-2026-37504

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions V2Board versions prior to 1.7.5

Description The server authentication token is accepted via a GET parameter in the app/Http/Controllers/Server/UniProxyController.php file. This causes the token to be exposed in URLs, such as the endpoint "/api/v1/server/UniProxy/user" through the token variable. Consequently, the sensitive information may be recorded in browser history, web server access logs, HTTP Referer headers, and proxy or CDN logs. An attacker with access to these logs can extract the token to impersonate a proxy server node and potentially intercept user traffic.

Recommendations Update to a version later than 1.7.4. As a temporary mitigation, restrict access to the "/api/v1/server/UniProxy/user" endpoint to trusted IP addresses to minimize the risk of token exposure in logs.

Exploit

Fix

Weakness Enumeration

CWE-598

Related Identifiers

CVE-2026-37504

Affected Products

V2Board

References · 6

• 🔥 https://gist.github.com/sgInnora/1330e1a82caa79906eec55eeff2c99b9 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-37504 · Security Note
• https://github.com/v2board/v2board · Note
• https://t.me/cveNotify/163083 · Telegram Post
• https://twitter.com/CVEnew/status/2050254033588293867 · Twitter Post
• https://t.me/cveNotify/162567 · Telegram Post