PT-2026-23756 · Flare · Flare

Published 2026-03-04 · Updated 2026-03-07 · CVE-2026-30231

Positive Technologies (AI Summary)

CVSS v4.0

6.0

Medium

Base vector

AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Flare versions prior to 1.7.2

Description Flare, a Next.js-based file sharing platform, had a flaw where authenticated, non-owner users could access private files if they knew the file URL. This occurred because the raw and direct file routes only blocked unauthenticated users, lacking the stricter checks used by other endpoints.

Recommendations Update to version 1.7.2 or later.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

BDU:2026-05297

CVE-2026-30231

GHSA-GWQR-XF5C-5569

Affected Products

Flare

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30231.json · Exploit
• https://github.com/FlintSH/Flare/security/advisories/GHSA-gwqr-xf5c-5569 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-30231 · Security Note
• https://osv.dev/vulnerability/CVE-2026-30231 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-05297 · Security Note
• https://twitter.com/CVEnew/status/2030385153587941618 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2030109403093856367 · Twitter Post
• https://t.me/CVEtracker/46653 · Telegram Post