Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Flare is a Next.js-based, self-hostable file sharing platform that integrates with screenshot tools. Prior to version 1.7.2, the raw and direct file routes only block unauthenticated users from accessing private files. Any authenticated, non‑owner user who knows the file URL can retrieve the content, which is inconsistent with stricter checks used by other endpoints. This issue has been patched in version 1.7.2.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-30231 Flare is a Next.js-based, self-hostable file sharing platform that integrates with screenshot tools. Prior to version 1.7.2, the raw and direct file routes only block… https://www.cve.org/CVERecord?id=CVE-2026-30231
Post summary
The passage announces CVE-2026-30231 affecting Flare’s file routes before version 1.7.2, with limited technical detail and no evidence of exploitation or remediation.
CVE-2026-30231 Authenticated File Access Bypass in Flare File Sharing Platform Before 1.7.2 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-30231
Post summary
A CVE (CVE-2026-30231) describing an authenticated file access bypass in Flare File Sharing Platform versions before 1.7.2 is disclosed; no PoC, exploit, or patch information is provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | flintsh | flare | - | - | - |