CVE-2025-59932
HighCVSS 8.6Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
Flag Forge is a Capture The Flag (CTF) platform. From versions 2.0.0 to before 2.3.1, the /api/resources endpoint previously allowed POST and DELETE requests without proper authentication or authorization. This could have enabled unauthorized users to create, modify, or delete resources on the platform. The issue has been fixed in FlagForge version 2.3.1.
Risk Assessment
Unauthorized users could manipulate platform resources, potentially leading to data integrity compromise, disruption of operations, or unauthorized access to sensitive information.
Recommendation
It is recommended to update Flag Forge to version 2.3.1 or later, which includes a fix enforcing proper authentication and authorization for the /api/resources endpoint.
Other vulnerabilities in Flag Forge
See all- CVE-2026-21868High
Flag Forge versions 2.3.2 and below have a Regular Expression Denial of Service (ReDoS) vulnerability in the user profile API endpoint (/api/user/[username]). The application constructs a regular expression dynamically using unescaped user input (the username parameter). An attacker can exploit this by sending a specially crafted username containing regex meta-characters (e.g., deeply nested groups or quantifiers), causing the MongoDB regex engine to consume excessive CPU resources. This can lead to Denial of Service for other users. The issue is fixed in version 2.3.3. To workaround this issue, implement a Web Application Firewall (WAF) rule to block requests containing regex meta-characters in the URL path.
- CVE-2025-61777Critical
Flag Forge versions starting from 2.0.0 and prior to 2.3.2 had the `/api/admin/badge-templates` (GET) and `/api/admin/badge-templates/create` (POST) endpoints accessible without authentication or authorization. This allowed unauthorized users to retrieve all badge templates and sensitive metadata and/or create arbitrary badge templates in the database. The issue is fixed in version 2.3.2.
- CVE-2025-59843Medium
Flag Forge CTF platform versions 2.0.0 to before 2.3.2 expose user email addresses in the JSON response of the public endpoint /api/user/[username]. The fix, available from 2.3.2, removes emails from public API responses. No workarounds exist.
Original NVD description (English source)
Flag Forge is a Capture The Flag (CTF) platform. From versions 2.0.0 to before 2.3.1, the /api/resources endpoint previously allowed POST and DELETE requests without proper authentication or authorization. This could have enabled unauthorized users to create, modify, or delete resources on the platform. The issue has been fixed in FlagForge version 2.3.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS