CVE-2026-30230 Flare: Password‑Protected Thumbnail Bypass
Attackers can bypass password protection to view thumbnails of protected files in the Flare file sharing platform.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-30230?
CVE-2026-30230 is a high-severity authentication bypass vulnerability in FlintSH Flare, published on 6 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Flare is a Next.js-based, self-hostable file sharing platform that integrates with screenshot tools. Prior to version 1.7.2, the thumbnail endpoint does not validate the password for password‑protected files. It checks ownership/admin for private files but skips password verification, allowing thumbnail access without the password. This issue has been patched in version 1.7.2.
Weakness: CWE-639
Which versions are affected by CVE-2026-30230?
It affects 1 product.
Products include Flintsh Flare.
How do I fix CVE-2026-30230?
No fix has been published for CVE-2026-30230 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-30230 being exploited?
There is no known exploitation of CVE-2026-30230 in the wild and no public exploit code.
Other vulnerabilities in FlintSH Flare
Sources
Also known as GHSA-3x7v-x3r6-mjh7.