GCVE - cpe:2.3:a:thehive-project:thehive:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:thehive-project:thehive:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Thehive Project (`4739e892-e7f5-575b-bd1a-1e7d63515d75`)
Product	Thehive (`c226c47d-575f-5650-9d4a-1834003b72fd`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:docker/thehiveproject/thehive`	purl2cpe	2026-06-01 10:12:33.074792
`pkg:github/thehive-project/thehive`	purl2cpe	2026-06-01 10:12:33.074794

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-63099`	vulnerable	2026-07-29 01:06:19.302861	TheHive 4.1.24 Broken Object Level Authorization via Attachment Download Endpoints MEDIUM (6.5) TheHive through 4.1.24 contains a broken object-level authorization vulnerability in the attachment download endpoints that allows any authenticated user to access attachments belonging to other organizations by supplying a content-hash identifier. Attackers can exploit the missing organization-scoped authorization check in AttachmentSrv.visible, which is implemented as a pass-through traversal, to download arbitrary attachments. Published: 2026-07-17T15:39:44.235Z Updated: 2026-07-28T01:05:27.422Z Open on db.gcve.eu Reference links https://github.com/geo-chen/oss/blob/main/TheHive.md#finding-2-cross-organisation-attachment-disclosure-via-unauthorized-datastore-endpoint-missing-object-level-authorization https://www.vulncheck.com/advisories/thehive-broken-object-level-authorization-via-attachment-download-endpoints	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-63098`	vulnerable	2026-07-29 01:06:19.302448	TheHive 4.1.24 Unauthenticated Information Disclosure via /api/status Endpoint MEDIUM (5.3) TheHive through 4.1.24 contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to retrieve sensitive configuration data by sending a GET request to the /api/status endpoint, which lacks authentication enforcement in the StatusCtrl.scala handler. Attackers can obtain the datastore attachment protection password, configured authentication providers, SSO settings, MFA capabilities, and clustered node addresses and roles without any credentials. Published: 2026-07-17T15:38:08.061Z Updated: 2026-07-28T01:50:01.477Z Open on db.gcve.eu Reference links https://github.com/geo-chen/oss/blob/main/TheHive.md#finding-1-get-apistatus-exposes-attachment-protection-password-without-authentication https://www.vulncheck.com/advisories/thehive-unauthenticated-information-disclosure-via-api-status-endpoint	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.