Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Flare is a Next.js-based, self-hostable file sharing platform that integrates with screenshot tools. Prior to version 1.7.2, the thumbnail endpoint does not validate the password for password‑protected files. It checks ownership/admin for private files but skips password verification, allowing thumbnail access without the password. This issue has been patched in version 1.7.2.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-30230 Flare is a Next.js-based, self-hostable file sharing platform that integrates with screenshot tools. Prior to version 1.7.2, the thumbnail endpoint does not validate … https://www.cve.org/CVERecord?id=CVE-2026-30230
Post summary
The text provides a brief technical detail about CVE-2026-30230 but lacks evidence of PoC, exploit code, active use, or mitigation.
CVE-2026-30230 Unauthenticated Thumbnail Access Vulnerability in Flare F... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-30230 Don't wait vulnerability scanning results: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=2
Post summary
A new vulnerability, CVE‑2026‑30230, has been disclosed as an unauthenticated thumbnail access flaw in Flare F. Details are provided via a link to the Vulmon database.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | flintsh | flare | - | - | - |