CVE-2026-30230 HIGH

CVE-2026-30230: Flare: Password‑Protected Thumbnail Bypass

Vendor Flintsh

Product Flare

Weakness CWE-639 · IDOR

Published March 6, 2026

Last update March 9, 2026

View on NVD All CVEs

CVSS base score

8.2/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Flare is a Next.js-based, self-hostable file sharing platform that integrates with screenshot tools. Prior to version 1.7.2, the thumbnail endpoint does not validate the password for password‑protected files. It checks ownership/admin for private files but skips password verification, allowing thumbnail access without the password. This issue has been patched in version 1.7.2.

Key dates

02Disclosure timeline

March 6, 2026 CVE published

March 9, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-30230 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/639.html