CVE-2026-100418

MEDIUM 5.3

Flame through 2.4.0 Information Exposure via GET /api/config

CVSS Score

5.3

EPSS Score

0.0%

EPSS Percentile

0th

Flame through 2.4.0 contains an information exposure vulnerability in the unauthenticated GET /api/config endpoint that returns the entire configuration object without field redaction. Attackers can retrieve the stored weather API key and internal operational settings by sending a single unauthenticated request to consume provider quota or access sensitive configuration data.

CWE	CWE-200
Vendor	pawelmalak
Product	flame
Published	Sep 25, 2026

Stay Ahead of the Next One

Get instant alerts for pawelmalak flame

Be the first to know when new medium vulnerabilities affecting pawelmalak flame are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Affected Versions

pawelmalak / flame

0 ≤ 2.4.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/pawelmalak/flame/issues/494 github.com: https://github.com/pawelmalak/flame/blob/3e03c25138df4321143c4fbd1a99468ff375ebb2/controllers/config/getConfig.js#L7-L13 github.com: https://github.com/pawelmalak/flame/blob/3e03c25138df4321143c4fbd1a99468ff375ebb2/routes/config.js#L14 github.com: https://github.com/pawelmalak/flame/blob/3e03c25138df4321143c4fbd1a99468ff375ebb2/utils/init/initialConfig.json#L2 github.com: https://github.com/pawelmalak/flame vulncheck.com: https://www.vulncheck.com/advisories/flame-through-2.4.0-information-exposure-via-get-api-config

Credits

Lazizbek Djurayev (Haad TC)