CVE-2025-48741: TheHive Access Control Bypass Vulnerability

CVE-2025-48741 Overview

CVE-2025-48741 is a Broken Access Control vulnerability in StrangeBee TheHive, an open-source Security Incident Response Platform (SIRP) used by security teams to manage alerts, cases, and investigations. The flaw allows remote, authenticated, unprivileged users to retrieve alerts, cases, logs, observables, or tasks through a specific API endpoint, regardless of their assigned permissions. Affected versions include TheHive 5.2.0 before 5.2.16, 5.3.0 before 5.3.11, and 5.4.0 before 5.4.10. The weakness is classified under [CWE-266] Incorrect Privilege Assignment.

Critical Impact
Any authenticated low-privilege TheHive user can access sensitive incident response data across the platform, exposing investigation content that should be restricted by organizational and role-based access controls.

Affected Products

StrangeBee TheHive 5.2.0 through 5.2.15
StrangeBee TheHive 5.3.0 through 5.3.10
StrangeBee TheHive 5.4.0 through 5.4.9

Discovery Timeline

2025-05-23 - CVE-2025-48741 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-48741

Vulnerability Analysis

TheHive exposes REST API endpoints that let users query incident response data such as alerts, cases, tasks, observables, and logs. Access to these objects is normally gated by organizational membership and role-based permissions. A specific API endpoint fails to apply these authorization checks correctly. As a result, any authenticated user with the lowest privilege level can retrieve records that belong to other users, teams, or organizations hosted on the same instance.

Because TheHive stores threat intelligence, ongoing investigations, and often personally identifiable information tied to incidents, unauthorized retrieval of these records can expose sensitive operational security data. Confidentiality impact is high while integrity and availability are unaffected, consistent with a read-only information disclosure flaw.

Root Cause

The root cause is missing or incomplete authorization enforcement on a specific API route. The endpoint authenticates the caller but does not verify that the caller has the required permission or organizational scope before returning the requested objects. This maps directly to [CWE-266] Incorrect Privilege Assignment, in which effective privileges do not match the user's assigned role.

Attack Vector

Exploitation requires network access to the TheHive API and valid credentials for any account, including the least-privileged role. The attacker sends crafted requests to the vulnerable endpoint and receives objects that should be inaccessible. No user interaction from a victim is required beyond the attacker's own authenticated session. Refer to the StrangeBeeCorp Security Advisory SB-SEC-ADV-2025-004 for endpoint-level details.

Detection Methods for CVE-2025-48741

Indicators of Compromise

Unusual volumes of API requests from a single authenticated user to alert, case, task, observable, or log retrieval endpoints.
Access patterns where a user account retrieves resources outside its assigned organization or team scope.
API traffic from service accounts or read-only accounts that suddenly enumerate identifiers sequentially.

Detection Strategies

Review TheHive application logs and reverse-proxy access logs for repeated GET requests targeting the affected API endpoint referenced in the vendor advisory.
Correlate authenticated user identity with the organizational scope of the returned objects to identify cross-tenant access.
Baseline normal per-user API request rates and alert on statistical anomalies indicative of bulk data harvesting.

Monitoring Recommendations

Forward TheHive API and audit logs to a centralized SIEM or data lake for long-term analysis.
Enable verbose audit logging on TheHive to capture the requesting user, endpoint, and response object identifiers.
Alert on any successful data retrieval by accounts whose role should not permit access to alerts, cases, or observables.

How to Mitigate CVE-2025-48741

Immediate Actions Required

Upgrade TheHive to version 5.2.16, 5.3.11, or 5.4.10 or later, depending on your deployment branch.
Rotate API keys and session credentials for all TheHive users after patching to invalidate any tokens that may have been used for unauthorized access.
Audit historical API logs for unauthorized data retrieval prior to the patch date and notify affected data owners.

Patch Information

StrangeBee released fixed builds in TheHive 5.2.16, 5.3.11, and 5.4.10. The vendor's remediation guidance is published in StrangeBeeCorp Security Advisory SB-SEC-ADV-2025-004. Administrators should follow the standard TheHive upgrade procedure and verify the running version after deployment.

Workarounds

Restrict network access to the TheHive API to trusted analyst workstations and jump hosts using firewall or reverse-proxy allow-lists until patching is complete.
Remove or disable unnecessary user accounts, particularly low-privilege or dormant accounts, to reduce the attacker population that can abuse the endpoint.
Enforce strong authentication and short-lived API tokens to limit the window in which a compromised low-privilege credential can be misused.

bash

# Verify installed TheHive version after upgrade
curl -s -H "Authorization: Bearer $THEHIVE_API_KEY" \
  https://thehive.example.com/api/v1/status | jq '.versions.TheHive'