CVE-2025-59826

Flag Forge versions 2.3.2 and below have a Regular Expression Denial of Service (ReDoS) vulnerability in the user profile API endpoint (/api/user/[username]). The application constructs a regular expression dynamically using unescaped user input (the username parameter). An attacker can exploit this by sending a specially crafted username containing regex meta-characters (e.g., deeply nested groups or quantifiers), causing the MongoDB regex engine to consume excessive CPU resources. This can lead to Denial of Service for other users. The issue is fixed in version 2.3.3. To workaround this issue, implement a Web Application Firewall (WAF) rule to block requests containing regex meta-characters in the URL path.

Flag Forge versions starting from 2.0.0 and prior to 2.3.2 had the `/api/admin/badge-templates` (GET) and `/api/admin/badge-templates/create` (POST) endpoints accessible without authentication or authorization. This allowed unauthorized users to retrieve all badge templates and sensitive metadata and/or create arbitrary badge templates in the database. The issue is fixed in version 2.3.2.

Flag Forge (CTF platform) versions 2.2.0 up to before 2.3.1 improperly handle session invalidation. Authenticated users can continue to access protected endpoints, such as /api/profile, even after logging out. CSRF tokens are also still valid post-logout, which can allow unauthorized actions. Patched in version 2.3.1.

Flag Forge is a Capture The Flag (CTF) platform. From versions 2.0.0 to before 2.3.1, the /api/resources endpoint previously allowed POST and DELETE requests without proper authentication or authorization. This could have enabled unauthorized users to create, modify, or delete resources on the platform. The issue has been fixed in FlagForge version 2.3.1.

Flag Forge CTF platform versions 2.0.0 to before 2.3.2 expose user email addresses in the JSON response of the public endpoint /api/user/[username]. The fix, available from 2.3.2, removes emails from public API responses. No workarounds exist.