CVE-2026-63099

MediumCVSS 6.5

Published: 17/07/2026(UTC)Updated: 17/07/2026(UTC)Translated: 18/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

11th percentile - higher than 11% of all known CVEs

Summary

TheHive through version 4.1.24 has a broken object-level authorization vulnerability in attachment download endpoints, allowing any authenticated user to access attachments from other organizations by supplying a content-hash identifier. The missing organization-scoped check in AttachmentSrv.visible enables attackers to download arbitrary attachments.

Risk Assessment

The organization risks exposure of sensitive data stored in attachments, which could be downloaded by unauthorized users from other organizations.

Recommendation

Upgrade TheHive to version 4.1.25 or later immediately, which includes a fix for the authorization bypass in attachment access.

Other vulnerabilities in TheHive

CVE-2026-63098Medium
TheHive up to version 4.1.24 contains an unauthenticated information disclosure vulnerability that allows attackers to retrieve sensitive configuration data by sending a GET request to the /api/status endpoint. The StatusCtrl.scala handler lacks authentication enforcement, exposing the datastore attachment protection password, configured authentication providers, SSO settings, MFA capabilities, and clustered node addresses and roles.

Original NVD description (English source)

TheHive through 4.1.24 contains a broken object-level authorization vulnerability in the attachment download endpoints that allows any authenticated user to access attachments belonging to other organizations by supplying a content-hash identifier. Attackers can exploit the missing organization-scoped authorization check in AttachmentSrv.visible, which is implemented as a pass-through traversal, to download arbitrary attachments.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS