TheHive 4.1.24 and earlier allow unauthenticated access to the /api/status endpoint because the StatusCtrl.scala handler does not enforce authentication enforcement. The endpoint returns sensitive configuration, such as the datastore attachment protection password, authentication provider settings, SSO and MFA configurations, and architecture details like node addresses and roles. As a missing authentication flaw (CWE‑306), any user with network access can read the response without credentials, exposing information that could be used to facilitate further attacks.

Deployments of TheHive-Project TheHive up to and including version 4.1.24. The vulnerability resides in the StatusCtrl.scala handler that serves the /api/status route.

The CVSS score of 6.9 classifies the vulnerability as moderate in severity. The EPSS score is below 1 %, indicating a low likelihood of exploitation at the time of this analysis. It is not listed in the CISA KEV catalog. The attack surface is a publicly or network‑visible HTTP endpoint; any attacker who can reach the server can retrieve the configuration data. Based on the description, the likely attack vector is exploiting the publicly exposed /api/status endpoint via unauthenticated HTTP GET requests. While the breach itself does not provide direct code execution, the disclosed credentials and settings could aid attackers in pivoting or gaining higher‑privilege access within the system.