CVE-2026-100418
Flame through 2.4.0 Information Exposure via GET /api/config
pawelmalak flame
CVSS
6.9MediumExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 29 Sep 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.34%Chance of exploitation activity in the next 30 days, higher than 26% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
Flame through 2.4.0 contains an information exposure vulnerability in the unauthenticated GET /api/config endpoint that returns the entire configuration object without field redaction. Attackers can retrieve the stored weather API key and internal operational settings by sending a single unauthenticated request to consume provider quota or access sensitive configuration data.
Text from CVE List
Affected versions 1
- flameaffected: all versions through 2.4.0CVE List
References 6
- vulncheck.com/advisories/flame-through-2.4.0-information-exposure-via-get-api-configAdvisoryvia CVE List
- github.com/pawelmalak/flame/issues/494Exploitvia CVE List
- github.com/pawelmalak/flame/blob/3e03c25138df4321143c4fbd1a99468ff375ebb2/controllers/config/getConfig.js#L7-L13Referencevia CVE List
- github.com/pawelmalak/flame/blob/3e03c25138df4321143c4fbd1a99468ff375ebb2/routes/config.js#L14Referencevia CVE List
- github.com/pawelmalak/flame/blob/3e03c25138df4321143c4fbd1a99468ff375ebb2/utils/init/initialConfig.json#L2Referencevia CVE List
- github.com/pawelmalak/flameReferencevia CVE List