EUVD-2026-45196
GHSA-f4pj-hh6r-99c8
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable endpoint requires no authentication (AV:N, PR:N, AC:L); confidentiality impact is low (C:L) as disclosure is configuration data, not full system access; no integrity or availability impact applies.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
TheHive through 4.1.24 contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to retrieve sensitive configuration data by sending a GET request to the /api/status endpoint, which lacks authentication enforcement in the StatusCtrl.scala handler. Attackers can obtain the datastore attachment protection password, configured authentication providers, SSO settings, MFA capabilities, and clustered node addresses and roles without any credentials.
AnalysisAI
Unauthenticated information disclosure in TheHive through 4.1.24 exposes sensitive configuration data - including the datastore attachment protection password, SSO settings, MFA capabilities, and clustered node addresses - to any network-reachable attacker via a single GET request to /api/status. The root cause is a missing authentication gate in the StatusCtrl.scala handler, a CWE-306 class defect. A public proof-of-concept is available on GitHub demonstrating trivial exploitation; no CISA KEV listing at time of analysis, though the exposed credentials materially increase lateral movement risk beyond the moderate CVSS score suggests.
Technical ContextAI
TheHive is a Scala-based open-source Security Incident Response Platform (SIRP) used by SOC and IR teams. The vulnerable component is StatusCtrl.scala, the controller backing the /api/status REST endpoint. CWE-306 (Missing Authentication for Critical Function) is the root cause class: the endpoint is designed for health and status checks but returns a JSON payload containing security-sensitive configuration fields - including the datastore attachment protection password, configured identity providers, SSO parameters, MFA feature flags, and cluster topology - without enforcing any authentication middleware. The affected product is identified by CPE cpe:2.3:a:thehive-project:thehive:*:*:*:*:*:*:*:*, covering all releases through version 4.1.24.
RemediationAI
No vendor-released patched version has been identified in the available data - the fix version is unconfirmed and should be verified directly with the TheHive project at their official repository. As an immediate compensating control, restrict unauthenticated access to the /api/status endpoint at the reverse-proxy or firewall layer (for example, block the path /api/status for unauthenticated external requests in nginx via a location block with allow/deny directives, or apply a WAF rule), accepting the trade-off that health monitoring integrations relying on unauthenticated status polling will break and require reconfiguration. If TheHive is not required to be internet-facing, enforce network perimeter controls to limit access to trusted internal subnets or VPN egress only. Regardless of patching status, treat the datastore attachment protection password and any SSO/identity provider credentials previously exposed by this endpoint as compromised - rotate them immediately. Consult https://www.vulncheck.com/advisories/thehive-unauthenticated-information-disclosure-via-api-status-endpoint for updated vendor guidance.
Cross-organization data disclosure in TheHive through 4.1.24 allows any authenticated user to download attachments belon
An issue in StrangeBee TheHive v.5.0.8, v.4.1.21 and Cortex v.3.1.6 allows a remote attacker to gain privileges via Acti
StrangeBee TheHive 5.2.0 to 5.2.8 is vulnerable to Cross Site Scripting (XSS) in the case reporting functionality. Rated
StrangeBee TheHive 5.1.0 to 5.1.9 and 5.2.0 to 5.2.8 is vulnerable to Cross Site Scripting (XSS) in the case attachment
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today