Read the docs
TI-2025-37282 Aliases CVE-2025-59843

FlagForgeCTF Exposes User Emails via Public /api/user/[username] API

Priority LOW 37CWE-359Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-359.

Summary

Flag Forge is a Capture The Flag (CTF) platform. From versions 2.0.0 to before 2.3.2, the public endpoint /api/user/[username] returns user email addresses in its JSON response. The fix, intended for release in 2.3.1 but only available starting in version 2.3.2, removes email addresses from public API responses while keeping the endpoint publicly accessible. Users should upgrade to version 2.3.2 or later to eliminate exposure. There are no workarounds for this vulnerability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00414 35th percentileScored 2026-11-07
Fix Fixed flagForge (FlagForgeCTF): 2.3.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
FlagForgeCTFflagForge2.0.0 to before 2.3.22.3.2Patch availableCNA
  • flagForge VendorFlagForgeCTF Affected 2.0.0 to before 2.3.2 Fixed in 2.3.2 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:flagforge:flagforge:*:*:*:*:*:*:*:*2.0 to before 2.3.1VulnerableFlagForgeCTF
  • cpe:2.3:a:flagforge:flagforge:*:*:*:*:*:*:*:* Versions 2.0 to before 2.3.1 Vulnerable ·FlagForgeCTF

Remediation

  • Fix · CNA flagForge (FlagForgeCTF) Fixed in 2.3.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-59843

References

Advisory 1

Other 3

  • TI-2025-38170 FlagForge Allows Unauthenticated Badge Template API Access CVSS 3.1CRITICAL 9.4
  • TI-2025-37280 FlagForgeCTF's Improper Session Handling Allows Access After Logout CVSS 3.1CRITICAL 9.8
  • TI-2025-37266 FlagForgeCTF is Missing Authorization in main-v2 CVSS 3.1CRITICAL 9.8
  • TI-2025-37320 FlagForgeCTF Unauthenticated Resource Modification/Deletion CVSS 3.1HIGH 8.6
  • TI-2026-17569 Flag Forge has ReDoS Vulnerability in User Profile Lookup API CVSS 3.1HIGH 7.5
  • TI-2025-37272 FlagForgeCTF Hint Exposure via API CVSS 3.1HIGH 7.5
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences