CVE-2026-30230

CVE-2026-30230 is a high-severity vulnerability affecting Flare, a Next.js-based file sharing platform, prior to version 1.7.2. The flaw allows unauthorized access to thumbnails of password-protected files because the thumbnail endpoint fails to validate the password, even though it checks for ownership or admin status on private files. This allows an attacker to view sensitive content without proper authentication. The vulnerability has a CVSS score of 8.2 (HIGH), indicating a network-based attack with low attack complexity and no user interaction required, leading to high confidentiality impact. While the EPSS score is low, suggesting limited current exploitability, the FAUCET Risk Score is 40/100. Currently, there is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. The vulnerability has also received minimal community discussion and media coverage.