TheHive EUVD-2026-45197

Exploitation requires a valid authenticated TheHive account (PR:L) with network access to the attachment download endpoints, and knowledge of a valid content-hash identifier for the target attachment, which is supplied directly to trigger AttachmentSrv.visible's pass-through traversal. The vulnerability is only meaningful on multi-organization (multi-tenant) TheHive deployments through version 4.1.24, since the attack crosses the organization boundary; a single-organization instance has no other tenant's data to disclose. Limiting factors: the attacker cannot be fully unauthenticated (a login is mandatory), must possess or obtain the content hash of the desired attachment, and impact is confined to confidentiality (read/download of files) with no integrity or availability effect.

The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N, base 7.1) is internally consistent with the description: network-reachable, low complexity, requires low privileges (a valid authenticated account), no user interaction, and a pure confidentiality impact with no effect on integrity or availability. This is a real, credible priority for multi-tenant TheHive deployments because publicly available exploit code lowers the barrier to abuse and the platform holds highly sensitive incident-response data. The main mitigating factor is the PR:L requirement - an attacker must already hold a valid TheHive account, so this is primarily an insider or foothold-escalation risk rather than a fully unauthenticated internet-wide exposure. A further practical limiter is that the attacker must know or guess a valid content-hash identifier; the description does not indicate hashes are enumerable, so exploitation may depend on hash disclosure through other channels. No EPSS score, KEV listing, or SSVC decision data was provided in the input, so widespread automated exploitation cannot be assessed from the available signals - the standout signal here is confirmed POC availability, not confirmed active exploitation.

A low-privileged analyst in Organization A (or an attacker who has phished/obtained any valid TheHive account) obtains a content-hash of an attachment belonging to Organization B - for example leaked in a shared report, API response, or prior access. Using the public POC technique, they issue an authenticated request to the attachment download endpoint supplying that hash and retrieve the file directly, bypassing organization isolation. Given AV:N/AC:L and available exploit code, this requires only a valid session and a known hash, with no special tooling or user interaction from the victim.