CVE-2026-63099

Name of the Vulnerable Software and Affected Versions TheHive versions prior to 4.1.25

Description An issue exists in the attachment download endpoints where a broken object-level authorization allows any authenticated user to access attachments from other organizations. This occurs because the AttachmentSrv.visible() function, which operates as a pass-through traversal, lacks an organization-scoped authorization check. An attacker can exploit this by providing a content-hash identifier to download arbitrary attachments.

Recommendations Update to version 4.1.25 or later. As a temporary mitigation, restrict access to the attachment download endpoints to trusted users only.