CVE-2026-63099: Thehive-Project Thehive

Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days.

TheHive through 4.1.24 contains a broken object-level authorization vulnerability in the attachment download endpoints that allows any authenticated user to access attachments belonging to other organizations by supplying a content-hash identifier. Attackers can exploit the missing organization-scoped authorization check in AttachmentSrv.visible, which is implemented as a pass-through traversal, to download arbitrary attachments.

Affected products

• Thehive-Project Thehive: up to and including 4.1.24

Published 2026-07-17. Last modified 2026-07-17.