Flare: Password‑Protected Thumbnail Bypass
Priority LOW 36CWE-639Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.
Summary
Flare is a Next.js-based, self-hostable file sharing platform that integrates with screenshot tools. Prior to version 1.7.2, the thumbnail endpoint does not validate the password for password‑protected files. It checks ownership/admin for private files but skips password verification, allowing thumbnail access without the password. This issue has been patched in version 1.7.2.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00415 36th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Flare (FlintSH): 1.7.2
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
- Fix · CNA Flare (FlintSH) Fixed in 1.7.2
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2026-30230
References
More FlintSH Flare vulnerabilities
- TI-2026-23767 Flare has a Path Traversal in /api/avatars/[filename] CVSS 4.0HIGH 8.3
- TI-2026-23464 Flare: Private File IDOR via raw/direct endpoints CVSS 4.0MEDIUM 6.0
- TI-2026-21472 Flare has XSS vulnerability in Raw File Preview CVSS 3.1MEDIUM 5.4
Sources
- CVE-2026-30230 · CVE Program
- CVE-2026-30230 · NVD
- FIRST EPSS
- CVE-2026-30230 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences