CVE-2026-30231

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-30231", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-04T17:23:59.798Z", "datePublished": "2026-03-06T21:10:41.969Z", "dateUpdated": "2026-03-09T20:54:28.901Z"}, "containers": {"cna": {"title": "Flare: Private File IDOR via raw/direct endpoints", "problemTypes": [{"descriptions": [{"cweId": "CWE-639", "lang": "en", "description": "CWE-639: Authorization Bypass Through User-Controlled Key", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/FlintSH/Flare/security/advisories/GHSA-gwqr-xf5c-5569", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/FlintSH/Flare/security/advisories/GHSA-gwqr-xf5c-5569"}], "affected": [{"vendor": "FlintSH", "product": "Flare", "versions": [{"version": "< 1.7.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-06T21:10:41.969Z"}, "descriptions": [{"lang": "en", "value": "Flare is a Next.js-based, self-hostable file sharing platform that integrates with screenshot tools. Prior to version 1.7.2, the raw and direct file routes only block unauthenticated users from accessing private files. Any authenticated, non\u2011owner user who knows the file URL can retrieve the content, which is inconsistent with stricter checks used by other endpoints. This issue has been patched in version 1.7.2."}], "source": {"advisory": "GHSA-gwqr-xf5c-5569", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-30231", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-09T20:45:39.677259Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-09T20:54:28.901Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-30231", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-09T20:45:39.677259Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-09T20:47:32.329Z"}}], "cna": {"title": "Flare: Private File IDOR via raw/direct endpoints", "source": {"advisory": "GHSA-gwqr-xf5c-5569", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "FlintSH", "product": "Flare", "versions": [{"status": "affected", "version": "< 1.7.2"}]}], "references": [{"url": "https://github.com/FlintSH/Flare/security/advisories/GHSA-gwqr-xf5c-5569", "name": "https://github.com/FlintSH/Flare/security/advisories/GHSA-gwqr-xf5c-5569", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Flare is a Next.js-based, self-hostable file sharing platform that integrates with screenshot tools. Prior to version 1.7.2, the raw and direct file routes only block unauthenticated users from accessing private files. Any authenticated, non\u2011owner user who knows the file URL can retrieve the content, which is inconsistent with stricter checks used by other endpoints. This issue has been patched in version 1.7.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639: Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-06T21:10:41.969Z"}}}, "cveMetadata": {"cveId": "CVE-2026-30231", "state": "PUBLISHED", "dateUpdated": "2026-03-09T20:54:28.901Z", "dateReserved": "2026-03-04T17:23:59.798Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-06T21:10:41.969Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Flare", "vendor": "FlintSH", "versions": [{"status": "affected", "version": "< 1.7.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:flintsh:flare:*:*:*:*:*:*:*:*", "matchCriteriaId": "4166EF32-3722-49DA-8764-A48E4CE75863", "versionEndExcluding": "1.7.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Flare is a Next.js-based, self-hostable file sharing platform that integrates with screenshot tools. Prior to version 1.7.2, the raw and direct file routes only block unauthenticated users from accessing private files. Any authenticated, non\u2011owner user who knows the file URL can retrieve the content, which is inconsistent with stricter checks used by other endpoints. This issue has been patched in version 1.7.2."}, {"lang": "es", "value": "Flare es una plataforma para compartir archivos autoalojable, basada en Next.js, que se integra con herramientas de captura de pantalla. Antes de la versi\u00f3n 1.7.2, las rutas de archivo sin procesar y directas solo bloqueaban el acceso de usuarios no autenticados a archivos privados. Cualquier usuario autenticado no propietario que conozca la URL del archivo puede recuperar el contenido, lo cual es inconsistente con las comprobaciones m\u00e1s estrictas utilizadas por otros puntos finales. Este problema ha sido parcheado en la versi\u00f3n 1.7.2."}], "id": "CVE-2026-30231", "lastModified": "2026-06-17T10:32:31.893", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.0, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-30231", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-09T20:45:39.677259Z", "version": "2.0.3"}}]}, "published": "2026-03-06T21:16:17.223", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/FlintSH/Flare/security/advisories/GHSA-gwqr-xf5c-5569"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "flare: Flare: Information disclosure via inconsistent access checks for private files", "id": "2445348", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445348"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-639", "details": ["A flaw was found in Flare, a self-hostable file sharing platform. An authenticated user, who is not the owner of a private file, can access and retrieve the content of that file by knowing its URL and using the raw and direct file routes. This is due to inconsistent access control checks compared to other endpoints, leading to unauthorized information disclosure."], "name": "CVE-2026-30231", "public_date": "2026-03-06T21:10:41Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-30231\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-30231\nhttps://github.com/FlintSH/Flare/security/advisories/GHSA-gwqr-xf5c-5569"], "statement": "This MODERATE vulnerability in Flare allows authenticated users to retrieve private files owned by others via raw and direct file routes. These endpoints only check for authentication, not ownership, creating an authorization bypass. Impact is high confidentiality loss since full file contents are exposed, but requires valid authentication and knowledge of the file URL.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.7.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Flare", "source": "cna", "vendor": "FlintSH"}, "product": "flare", "vendor": "flintsh"}], "analysis": {"en": {"generated_at": "2026-04-17T12:17:30.344771+00:00", "value": {"mitigation_remediation": ["Upgrade to Flare 1.7.2 or later", "Restrict access to raw and direct endpoints to authenticated users only and monitor for unauthorized file access", "Implement monitoring for anomalous file access patterns"], "summary": {"action": "Apply patch", "impact": "Unauthorized access to private files"}, "threat_synthesis": {"affected_systems": "The affected product is FlintSH\u2019s Flare file sharing platform. All versions prior to 1.7.2 are vulnerable because the raw and direct file routes only block unauthenticated users, not other authenticated users. No other vendors or products are listed as impacted.", "description_and_impact": "Flare, a Next.js\u2011based file sharing platform, allowed any authenticated user who knew a private file\u2019s URL to retrieve that file through its raw and direct endpoints before version 1.7.2. This missing ownership check is an IDOR flaw (CWE\u2011639) that enables attackers to read private data they do not own, thereby breaching confidentiality.", "risk_and_exploitability": "The CVSS score is 6, indicating moderate severity, while the EPSS score is below 1\u202f%, implying that exploitation is currently unlikely but not impossible. The vulnerability is not in CISA\u2019s KEV catalog. An attacker must first be authenticated and obtain the file\u2019s URL; no privileged access or additional conditions are required. The overall risk to an organization depends on user roles and the sensitivity of the stored files, but the exploitation likelihood remains low."}}}}, "created": "2026-03-09T10:06:51.378660+00:00", "updated": "2026-04-17T12:30:06.218535+00:00", "vendors": ["flintsh", "flintsh$PRODUCT$flare"]}