CVE-2026-30231 — Flare: Private File IDOR via raw/direct endpoints
Flare is a Next.js-based, self-hostable file sharing platform that integrates with screenshot tools. Prior to version 1.7.2, the raw and direct file routes only block unauthenti…
Published: 2026-03-06 · CVSS: 6.0 · CVSS 4.0
Flare is a Next.js-based, self-hostable file sharing platform that integrates with screenshot tools. Prior to version 1.7.2, the raw and direct file routes only block unauthenticated users from accessing private files. Any authenticated, non‑owner user who knows the file URL can retrieve the content, which is inconsistent with stricter checks used by other endpoints. This issue has been patched in version 1.7.2.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7