CVE-2025-61777
CriticalCVSS 9.4Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
Flag Forge versions starting from 2.0.0 and prior to 2.3.2 had the `/api/admin/badge-templates` (GET) and `/api/admin/badge-templates/create` (POST) endpoints accessible without authentication or authorization. This allowed unauthorized users to retrieve all badge templates and sensitive metadata and/or create arbitrary badge templates in the database. The issue is fixed in version 2.3.2.
Risk Assessment
Unauthorized access could lead to data exposure (metadata, creator information) and database pollution with fake badge templates. This could be abused to manipulate the badge system and rankings.
Recommendation
Update Flag Forge to version 2.3.2 or later, which requires authentication and authorization for all badge template operations. No reliable workarounds are available.
Other vulnerabilities in Flag Forge
See all- CVE-2026-21868High
Flag Forge versions 2.3.2 and below have a Regular Expression Denial of Service (ReDoS) vulnerability in the user profile API endpoint (/api/user/[username]). The application constructs a regular expression dynamically using unescaped user input (the username parameter). An attacker can exploit this by sending a specially crafted username containing regex meta-characters (e.g., deeply nested groups or quantifiers), causing the MongoDB regex engine to consume excessive CPU resources. This can lead to Denial of Service for other users. The issue is fixed in version 2.3.3. To workaround this issue, implement a Web Application Firewall (WAF) rule to block requests containing regex meta-characters in the URL path.
- CVE-2025-59932High
Flag Forge is a Capture The Flag (CTF) platform. From versions 2.0.0 to before 2.3.1, the /api/resources endpoint previously allowed POST and DELETE requests without proper authentication or authorization. This could have enabled unauthorized users to create, modify, or delete resources on the platform. The issue has been fixed in FlagForge version 2.3.1.
- CVE-2025-59843Medium
Flag Forge CTF platform versions 2.0.0 to before 2.3.2 expose user email addresses in the JSON response of the public endpoint /api/user/[username]. The fix, available from 2.3.2, removes emails from public API responses. No workarounds exist.
Original NVD description (English source)
Flag Forge is a Capture The Flag (CTF) platform. Starting in version 2.0.0 and prior to version 2.3.2, the `/api/admin/badge-templates` (GET) and `/api/admin/badge-templates/create` (POST) endpoints previously allowed access without authentication or authorization. This could have enabled unauthorized users to retrieve all badge templates and sensitive metadata (createdBy, createdAt, updatedAt) and/or create arbitrary badge templates in the database. This could lead to data exposure, database pollution, or abuse of the badge system. The issue has been fixed in FlagForge v2.3.2. GET, POST, UPDATE, and DELETE endpoints now require authentication. Authorization checks ensure only admins can access and modify badge templates. No reliable workarounds are available.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS