CVE-2026-63098 Details
Description
TheHive through 4.1.24 contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to retrieve sensitive configuration data by sending a GET request to the /api/status endpoint, which lacks authentication enforcement in the StatusCtrl.scala handler. Attackers can obtain the datastore attachment protection password, configured authentication providers, SSO settings, MFA capabilities, and clustered node addresses and roles without any credentials.
A vulnerability allowing unauthenticated information disclosure exists in TheHive versions through 4.1.24. The issue arises because the '/api/status' endpoint lacks proper authentication enforcement, allowing unauthenticated attackers to access sensitive configuration data. This includes the datastore attachment protection password, authentication provider settings, SSO and MFA capabilities, and information about clustered node addresses and roles.
To address this vulnerability, it is recommended to add authentication requirements to the '/api/status' endpoint. If a public status endpoint is necessary for load balancer health checks, it should be configured to return only a generic HTTP 200 response without any sensitive information.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/geo-chen/oss/blob/main/TheHive.md#finding-1-get-apistatus-exposes-attachment-protection-password-without-authentication | [email protected] | ExploitThird Party Advisory |
| https://www.vulncheck.com/advisories/thehive-unauthenticated-information-disclosure-via-api-status-endpoint | [email protected] | ExploitThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| strangebee thehive | <= 4.1.24 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 30, 2026 | Initial Analysis | [email protected] |
| Jul 17, 2026 | CVE Modified | CISA-ADP |
| Jul 17, 2026 | New CVE Received | [email protected] |