PT-2026-23755 · Flare · Flare

Published 2026-03-04 · Updated 2026-03-07 · CVE-2026-30230

Positive Technologies (AI Summary)

CVSS v4.0

8.2

High

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Flare versions prior to 1.7.2

Description Flare, a Next.js-based file sharing platform, had a flaw where the thumbnail endpoint did not properly verify passwords for password-protected files. The system checked for ownership or administrator privileges for private files but bypassed password verification, enabling unauthorized access to thumbnails.

Recommendations Update to version 1.7.2 or later.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

BDU:2026-05296

CVE-2026-30230

GHSA-3X7V-X3R6-MJH7

Affected Products

Flare

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30230.json · Exploit
• https://github.com/FlintSH/Flare/security/advisories/GHSA-3x7v-x3r6-mjh7 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-05296 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-30230 · Security Note
• https://osv.dev/vulnerability/CVE-2026-30230 · Vendor Advisory
• https://t.me/CVEtracker/46652 · Telegram Post
• https://twitter.com/CVEnew/status/2030385154552746414 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2030114523395268738 · Twitter Post