Flare, a Next.js‑based file sharing platform, allowed any authenticated user who knew a private file’s URL to retrieve that file through its raw and direct endpoints before version 1.7.2. This missing ownership check is an IDOR flaw (CWE‑639) that enables attackers to read private data they do not own, thereby breaching confidentiality.

The affected product is FlintSH’s Flare file sharing platform. All versions prior to 1.7.2 are vulnerable because the raw and direct file routes only block unauthenticated users, not other authenticated users. No other vendors or products are listed as impacted.

The CVSS score is 6, indicating moderate severity, while the EPSS score is below 1 %, implying that exploitation is currently unlikely but not impossible. The vulnerability is not in CISA’s KEV catalog. An attacker must first be authenticated and obtain the file’s URL; no privileged access or additional conditions are required. The overall risk to an organization depends on user roles and the sensitivity of the stored files, but the exploitation likelihood remains low.