Nixpkgs Security Tracker

Login with GitHub

Suggestion detail

Dismissed
Permalink CVE-2026-30231
updated 2 weeks, 2 days ago by @mweinelt Activity log
  • Created automatic suggestion 2 weeks, 2 days ago
  • @mweinelt removed
    27 packages
    • flare
    • flarectl
    • photoflare
    • cloudflared
    • flare-floss
    • gotlsaflare
    • flare-signal
    • flaresolverr
    • cloudflare-cli
    • cloudflare-ddns
    • cloudflare-warp
    • cloudflare-utils
    • cloudflare-dyndns
    • speed-cloudflare-cli
    • cloudflare-dynamic-dns
    • octodns-providers.cloudflare
    • python312Packages.cloudflare
    • python313Packages.cloudflare
    • python314Packages.cloudflare
    • prometheus-cloudflare-exporter
    • terraform-providers.cloudflare
    • gnomeExtensions.cloudflare-warp-toggle
    • home-assistant-component-tests.cloudflare
    • terraform-providers.cloudflare_cloudflare
    • tests.home-assistant-component-tests.cloudflare
    • tests.home-assistant-component-tests.cloudflare_r2
    • haskellPackages.hs-opentelemetry-instrumentation-cloudflare
    2 weeks, 2 days ago
  • @mweinelt dismissed 2 weeks, 2 days ago
Flare: Private File IDOR via raw/direct endpoints

Flare is a Next.js-based, self-hostable file sharing platform that integrates with screenshot tools. Prior to version 1.7.2, the raw and direct file routes only block unauthenticated users from accessing private files. Any authenticated, non‑owner user who knows the file URL can retrieve the content, which is inconsistent with stricter checks used by other endpoints. This issue has been patched in version 1.7.2.

References

Affected products

Flare
  • ==< 1.7.2
Ignored packages (27) 
Not in nixpkgs