VULNERABILITY INTELLIGENCE

CVE-2026-30231

CVSS score5.3 MEDIUM
EPSS probability0.31%
CISA KEVNot currently listed
Published2026-03-06
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Description

Flare is a Next.js-based, self-hostable file sharing platform that integrates with screenshot tools. Prior to version 1.7.2, the raw and direct file routes only block unauthenticated users from accessing private files. Any authenticated, non‑owner user who knows the file URL can retrieve the content, which is inconsistent with stricter checks used by other endpoints. This issue has been patched in version 1.7.2.

Weakness classification

  • security-advisories@github.com: CWE-639

Primary references