Executive brief
TheHive, a popular security incident response platform, contains a flaw that allows users to access files they are not authorized to see. An authenticated user from one organization can view and download file attachments belonging to entirely different organizations by guessing or obtaining a specific file identifier. This could lead to the exposure of sensitive investigation data, evidence, and internal security reports to unauthorized parties.
Technical details
A broken object-level authorization (BOLA) vulnerability exists in TheHive versions up to and including 4.1.24. The flaw is located within the attachment download endpoints, specifically due to a missing organization-scoped authorization check in the 'AttachmentSrv.visible' function. This function is implemented as a pass-through traversal, failing to verify if the requesting user's organization has permission to access the requested object. An attacker with valid credentials for any organization on the platform can download arbitrary attachments from other organizations by supplying the target file's content-hash identifier. The repository for this version of the software was archived in late 2025, and users should verify if patches are available for their specific deployment.
Affected products
- TheHive-Project TheHive through 4.1.24
Timeline
- 2026-07-17: advisory: NVD and VulnCheck published the advisory