Authenticated private-file disclosure via incomplete route authorization

Authorization bypass in FlintSH Flare before 1.7.2 allows remote authenticated users to read other users' private files via known URLs. The raw and direct route predicates restrict a private file only when no session user exists, without checking whether the requester owns the file or is an administrator. Exploitation requires a valid low-privilege account and a private file URL; it discloses content without modifying data or interrupting service.