Which versions of TheHive are affected by CVE-2026-63099?

TheHive versions through 4.1.24 contain an authorization bypass allowing authenticated users to access and download sensitive incident attachments belonging to other organizations.

Is there a public PoC exploit available for CVE-2026-63099?

Yes, a public proof-of-concept exploit is available for CVE-2026-63099. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-63099?

Within 24 hours: Identify all TheHive instances running version 4.1.24 or earlier and restrict network access to trusted internal networks only; limit authenticated user accounts to minimum required scope and establish monitoring of attachment download logs for cross-organization access patterns. Within 7 days: Implement organization-level access controls if available in your TheHive deployment and conduct a full audit of attachment download logs for the past 30 days to identify any unauthorized cross-organizational access. Within 30 days: Monitor vendor advisories for patch release and deploy immediately when available; if patch is not released within 60 days, evaluate migration to patched alternative incident response platforms or implement organizational isolation through separate TheHive instances per organization.

TheHive CVE-2026-63099

Q: What is the CVSS score of CVE-2026-63099?

CVE-2026-63099 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-45197 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-17 VulnCheck

GHSA-6392-9v2x-r546

Authentication Bypass Thehive Thehive Project

7.1

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.7 HIGH

Authenticated network access (PR:L, AV:N/AC:L) leaks another organization's data across a tenant boundary, so scope changes (S:C) with confidentiality-only impact (C:H, I/A:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 17, 2026 - 16:17 vuln.today

CVE Published

Jul 17, 2026 - 15:39 cve.org

HIGH 7.1

DescriptionCVE.org

TheHive through 4.1.24 contains a broken object-level authorization vulnerability in the attachment download endpoints that allows any authenticated user to access attachments belonging to other organizations by supplying a content-hash identifier. Attackers can exploit the missing organization-scoped authorization check in AttachmentSrv.visible, which is implemented as a pass-through traversal, to download arbitrary attachments.

AnalysisAI

Cross-organization data disclosure in TheHive through 4.1.24 allows any authenticated user to download attachments belonging to other organizations by supplying a known content-hash identifier. The flaw is a broken object-level authorization (BOLA/IDOR) in the attachment download endpoints, where AttachmentSrv.visible acts as a pass-through datastore traversal without enforcing organization scoping. Publicly available exploit code exists (published by VulnCheck / geo-chen), though there is no public exploit identified as actively exploited in the wild (not in CISA KEV).

Technical ContextAI

TheHive is an open-source Security Incident Response Platform (SIRP) used by SOC and CSIRT teams to collaboratively manage cases, alerts, observables, and their attached evidence files. Attachments in TheHive are stored in a content-addressable datastore keyed by a content hash rather than by a per-record, per-organization identifier. The vulnerability class is CWE-639 (Authorization Bypass Through User-Controlled Key): the download endpoint accepts an attacker-controllable hash and resolves it directly against the datastore. Because AttachmentSrv.visible is implemented as a pass-through traversal rather than a genuine tenant-aware authorization check, TheHive's multi-tenant organization isolation model is not applied at the object level, so ownership of the referenced attachment is never verified against the requesting user's organization membership. Affected component per CPE is cpe:2.3:a:thehive-project:thehive across all versions up to and including 4.1.24.

RemediationAI

No vendor-released patch version is identified in the available data, so upgrade to the vendor's fixed release once published and monitor the VulnCheck advisory (https://www.vulncheck.com/advisories/thehive-broken-object-level-authorization-via-attachment-download-endpoints) and TheHive project releases for a version beyond 4.1.24 that adds an organization-scoped authorization check to AttachmentSrv.visible. As compensating controls until a fix is available: restrict or segment tenants by running separate single-organization TheHive instances rather than a shared multi-organization deployment (trade-off: higher operational overhead and loss of cross-org collaboration features); tighten account provisioning and promptly deprovision accounts to minimize the pool of authenticated users who could abuse the flaw; and place the attachment download endpoints behind a reverse proxy or WAF with logging to detect and alert on anomalous or high-volume hash-based attachment requests (trade-off: hash-based access is hard to distinguish from legitimate downloads, so this is detective rather than fully preventive). Review datastore access logs for unexpected cross-organization attachment retrievals.