CVE-2026-63098

MediumCVSS 5.3

Published: 17/07/2026(UTC)Updated: 30/07/2026(UTC)Translated: 18/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

16th percentile - higher than 16% of all known CVEs

Summary

TheHive up to version 4.1.24 contains an unauthenticated information disclosure vulnerability that allows attackers to retrieve sensitive configuration data by sending a GET request to the /api/status endpoint. The StatusCtrl.scala handler lacks authentication enforcement, exposing the datastore attachment protection password, configured authentication providers, SSO settings, MFA capabilities, and clustered node addresses and roles.

Risk Assessment

The organization risks exposure of critical configuration data, including passwords and authentication infrastructure details, which could enable further attacks, account takeover, or system integrity compromise.

Recommendation

Immediately upgrade TheHive to a version newer than 4.1.24 where the vulnerability is patched. As a temporary measure, restrict access to the /api/status endpoint via firewall rules or authentication enforcement at the proxy level.

Other vulnerabilities in TheHive

CVE-2026-63099Medium
TheHive through version 4.1.24 has a broken object-level authorization vulnerability in attachment download endpoints, allowing any authenticated user to access attachments from other organizations by supplying a content-hash identifier. The missing organization-scoped check in AttachmentSrv.visible enables attackers to download arbitrary attachments.

Original NVD description (English source)

TheHive through 4.1.24 contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to retrieve sensitive configuration data by sending a GET request to the /api/status endpoint, which lacks authentication enforcement in the StatusCtrl.scala handler. Attackers can obtain the datastore attachment protection password, configured authentication providers, SSO settings, MFA capabilities, and clustered node addresses and roles without any credentials.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS