CVE-2026-63099 is a broken object-level authorization vulnerability affecting TheHive through version 4.1.24. The vulnerability exists in the attachment download endpoints where the service fails to enforce organization-scoped authorization checks. Specifically, the AttachmentSrv.visible method acts as a pass-through traversal without verifying that the requesting user belongs to the organization owning the attachment. As a result, any authenticated user can supply a content-hash identifier to access attachments from other organizations. This leads to unauthorized disclosure of potentially sensitive attachments. The vulnerability has a CVSS 4.0 base score of 7.1 (high severity) and does not require user interaction or elevated privileges beyond authentication. No vendor advisory or patch is currently available, and the product is not a cloud service, so remediation depends on vendor updates or user mitigation.

An authenticated user can bypass object-level authorization controls to access attachments belonging to other organizations. This unauthorized access can lead to disclosure of sensitive or confidential information contained in those attachments. The vulnerability does not require elevated privileges or user interaction beyond authentication, increasing the risk within multi-tenant or multi-organization deployments of TheHive. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should consider restricting access to TheHive to trusted users only and monitor for unusual attachment access patterns. No official remediation or temporary fix is currently documented.