TheHive Unauthenticated Information Disclosure Vulnerability

Executive Summary

CVE-2026-63098 is an unauthenticated information disclosure vulnerability in TheHive, a security incident response platform. It allows attackers to retrieve sensitive configuration data by sending a GET request to the /api/status endpoint without any credentials. Exposed data includes the datastore attachment protection password, authentication providers, SSO settings, MFA capabilities, and clustered node addresses and roles.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if unauthenticated requests to the /api/status endpoint return sensitive configuration data. Use curl to send a GET request to http://<target>/api/status and inspect the response for exposed passwords, authentication providers, SSO settings, or cluster details. Example command: curl -v http://<target>/api/status

For the second vulnerability, test if authenticated users can access attachments from other organizations by querying /api/v0/datastore/{id} or /api/v0/datastorezip/{id} with known content-hash identifiers.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized access to sensitive configuration details and potentially allow attackers to download malware attachments or forensic files if they obtain the attachment protection password through other means. In multi-tenant deployments, it may enable cross-organization attachment disclosure, exposing case evidence to unauthorized users.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized access to sensitive data. Exposure of authentication providers, SSO settings, and MFA capabilities may compromise user privacy and authentication security. The datastore attachment protection password could allow access to malware samples or forensic files containing personal or health data, violating confidentiality requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade TheHive to a patched version beyond 4.1.24. If upgrading is not possible, restrict access to the /api/status endpoint by implementing authentication checks or IP whitelisting. Disable cross-organization attachment access by enforcing object-level authorization in AttachmentSrv.visible.

Useful 0 Not Useful 0