CVE-2026-63098

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-63098
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63098.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-63098
Published
2026-07-17T15:38:08.061Z
Modified
2026-07-19T03:46:09.018754353Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
TheHive 4.1.24 Unauthenticated Information Disclosure via /api/status Endpoint
Details

TheHive through 4.1.24 contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to retrieve sensitive configuration data by sending a GET request to the /api/status endpoint, which lacks authentication enforcement in the StatusCtrl.scala handler. Attackers can obtain the datastore attachment protection password, configured authentication providers, SSO settings, MFA capabilities, and clustered node addresses and roles without any credentials.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63098.json",
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-306"
    ]
}
References

Affected packages

Git / github.com/thehive-project/thehive

Affected ranges

Type
GIT
Repo
https://github.com/thehive-project/thehive
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
b6649bb58938a414de9f0505cc0a1dad15f0d0ef
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "4.1.24"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

4.*
4.0.0
4.0.0-RC1
4.0.0-RC2
4.0.0-RC3
4.0.2
4.0.3
4.0.4
4.0.5
4.1.0
4.1.1
4.1.10
4.1.11
4.1.12
4.1.13
4.1.14
4.1.15
4.1.16
4.1.17
4.1.18
4.1.19
4.1.2
4.1.20
4.1.21
4.1.22
4.1.23
4.1.24
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63098.json"