The vulnerability exists because the thumbnail endpoint in Flare does not perform password verification for files that are protected by a user‑supplied password. While the endpoint still checks for ownership or administrative rights on private files, it skips the password check entirely for protected files. This omission allows anyone who can formulate a request to the thumbnail URL to retrieve a visual preview of the file without knowing the password, thereby bypassing the intended access control and potentially revealing sensitive data or file metadata.

FlintSH Flare prior to version 1.7.2. The flaw is present in any self‑hosted deployment of Flare that has not applied the patch included in release 1.7.2.

The CVSS score of 8.2 indicates a high severity vulnerability with complete data confidentiality impact. The EPSS score is below 1 %, and the vulnerability has not been identified in the CISA KEV catalog, suggesting a low probability of widespread exploitation. Nonetheless, the attack vector is straightforward: an attacker can issue a crafted HTTP request to the thumbnail endpoint for a known protected file, bypassing password authentication without requiring any additional credentials. The ease of exploitation combined with the high severity warrants prompt remediation.