CVE-2026-63098

Name of the Vulnerable Software and Affected Versions TheHive versions prior to 4.1.25

Description An unauthenticated information disclosure issue exists where attackers can retrieve sensitive configuration data by sending a GET request to the '/api/status' endpoint. This occurs because the StatusCtrl.scala handler fails to enforce authentication. Exposed data includes the datastore attachment protection password, configured authentication providers, SSO settings, MFA capabilities, and clustered node addresses and roles.

Recommendations Update to version 4.1.25 or later. As a temporary mitigation, restrict access to the '/api/status' endpoint.