Vulnerability Description
TheHive through 4.1.24 contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to retrieve sensitive configuration data by sending a GET request to the /api/status endpoint, which lacks authentication enforcement in the StatusCtrl.scala handler. Attackers can obtain the datastore attachment protection password, configured authentication providers, SSO settings, MFA capabilities, and clustered node addresses and roles without any credentials.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Strangebee | Thehive | <= 4.1.24 |
Related Weaknesses (CWE)
References
- https://github.com/geo-chen/oss/blob/main/TheHive.md#finding-1-get-apistatus-expExploitThird Party Advisory
- https://www.vulncheck.com/advisories/thehive-unauthenticated-information-disclosExploitThird Party Advisory
FAQ
What is CVE-2026-63098?
CVE-2026-63098 is a vulnerability with a CVSS score of 5.3 (MEDIUM). TheHive through 4.1.24 contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to retrieve sensitive configuration data by sending a GET request to the /...
How severe is CVE-2026-63098?
CVE-2026-63098 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-63098?
Check the references section above for vendor advisories and patch information. Affected products include: Strangebee Thehive.