# CVE-2025-46332: Information Disclosure via Flags override link

> CVE-2025-46332: Information Disclosure via Flags override link. CVSS 6.5 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2025-46332
Last updated: 2026-06-17T09:26:15Z

- Published: 2025-05-02 17:06 UTC · Updated: 2026-06-17 09:26 UTC · Assigner: GitHub\_M
- CVSS: 6.5 (CVSS 3.1) · Severity: Medium · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- EPSS: 0.33%, 26th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-200

## Description

Flags SDK is an open-source feature flags toolkit for Next.js and SvelteKit. Impacted versions include flags from 3.2.0 and prior and @vercel/flags from 3.1.1 and prior as certain circumstances allows a bad actor with detailed knowledge of the vulnerability to list all flags returned by the flags discovery endpoint (.well-known/vercel/flags). This vulnerability allows for information disclosure, where a bad actor could gain access to a list of all feature flags exposed through the flags discovery endpoint, including the flag names, flag descriptions, available options and their labels (e.g. true, false), and default flag values. This issue has been patched in flags@4.0.0, users of flags and @vercel/flags should also migrate to flags@4.0.0.

## Affected vendors and products

- vercel: flags

## Tracked companies

- [Vercel](https://rewindex.com/company/vercel.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2025-46332)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2025-46332)
- [https://github.com/vercel/flags/blob/main/packages/flags/guides/upgrade-to-v4.md](https://github.com/vercel/flags/blob/main/packages/flags/guides/upgrade-to-v4.md)
- [https://github.com/vercel/flags/security/advisories/GHSA-892p-pqrr-hxqr](https://github.com/vercel/flags/security/advisories/GHSA-892p-pqrr-hxqr)
- [https://vercel.com/changelog/information-disclosure-in-flags-sdk-cve-2025-46332](https://vercel.com/changelog/information-disclosure-in-flags-sdk-cve-2025-46332)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2025-46332 · Markdown: https://rewindex.com/cve/CVE-2025-46332.md · JSON: https://rewindex.com/api/v1/cves/CVE-2025-46332 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T03:10:55.687Z