CVE-2026-30231CWE-639

Flare: Private File IDOR via raw/direct endpoints

Medium · published March 6, 2026

CVSS v4.0
6.0
EPSS
0%
Percentile
23.8
In the wild
Unconfirmed
What it is

Flare is a Next.js-based, self-hostable file sharing platform that integrates with screenshot tools. Prior to version 1.7.2, the raw and direct file routes only block unauthenticated users from accessing private files. Any authenticated, non‑owner user who knows the file URL can retrieve the content, which is inconsistent with stricter checks used by other endpoints. This issue has been patched in version 1.7.2.

The record
Technical detail
CVSS v4.0
6.0 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00321 · 23.8th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-03-06T21:10Z
EPSS history
Timeline
  • 06 MAR 21:10Z
    Flare: Private File IDOR via raw/direct endpoints
    cvelistv5