PT-2026-60791 · Thehive · Thehive

George Chen · CVE-2026-63098 · Publicado 2026-07-17 · Atualizado 2026-07-17

Mitre

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

TheHive through 4.1.24 contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to retrieve sensitive configuration data by sending a GET request to the /api/status endpoint, which lacks authentication enforcement in the StatusCtrl.scala handler. Attackers can obtain the datastore attachment protection password, configured authentication providers, SSO settings, MFA capabilities, and clustered node addresses and roles without any credentials.

Exploit

Correção

Missing Authentication

Enumeração de Fraquezas

CWE-306

Identificadores relacionados

CVE-2026-63098

Produtos afetados

Thehive

Referências · 3

• 🔥 https://github.com/geo-chen/oss/blob/main/TheHive.md#finding-1-get-apistatus-exposes-attachment-protection-password-without-authentication · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-63098 · Nota de Segurança
• https://vulncheck.com/advisories/thehive-unauthenticated-information-disclosure-via-api-status-endpoint · Nota