TI-2025-38170 Aliases CVE-2025-61777

FlagForge Allows Unauthenticated Badge Template API Access

MEDIUM 49CWE-200Published 2025-10-06 · Updated 2026-01-28

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Information disclosure, Security bypass
Confidentiality · integrity · availability: High · High · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-200 and CWE-284.

Summary

Flag Forge is a Capture The Flag (CTF) platform. Starting in version 2.0.0 and prior to version 2.3.2, the `/api/admin/badge-templates` (GET) and `/api/admin/badge-templates/create` (POST) endpoints previously allowed access without authentication or authorization. This could have enabled unauthorized users to retrieve all badge templates and sensitive metadata (createdBy, createdAt, updatedAt) and/or create arbitrary badge templates in the database. This could lead to data exposure, database pollution, or abuse of the badge system. The issue has been fixed in FlagForge v2.3.2. GET, POST, UPDATE, and DELETE endpoints now require authentication. Authorization checks ensure only admins can access and modify badge templates. No reliable workarounds are available.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00451 39th percentileScored 2026-11-07

Fix Fixed flagForge (FlagForgeCTF): 2.3.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
FlagForgeCTF	flagForge	2.0.0 to before 2.3.2	2.3.2	Patch available	CNA

flagForge VendorFlagForgeCTF Affected 2.0.0 to before 2.3.2 Fixed in 2.3.2 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:flagforge:flagforge::::::::	2.0 to before 2.3.2	Vulnerable	FlagForgeCTF

cpe:2.3:a:flagforge:flagforge:*:*:*:*:*:*:*:* Versions 2.0 to before 2.3.2 Vulnerable ·FlagForgeCTF

Remediation

Fix · CNA flagForge (FlagForgeCTF) Fixed in 2.3.2

Timeline

2026-10-02 Threatist record created from CVE-2025-61777

References

Patch 1

https://github.com/FlagForgeCTF/flagForge/commit/e2121c5fb7a512a49dcd875812c944265fb1a846

Advisory 1

https://github.com/FlagForgeCTF/flagForge/security/advisories/GHSA-26rx-c53q-rjf9

TI-2025-37280 FlagForgeCTF's Improper Session Handling Allows Access After Logout CVSS 3.1CRITICAL 9.8
TI-2025-37266 FlagForgeCTF is Missing Authorization in main-v2 CVSS 3.1CRITICAL 9.8
TI-2025-37320 FlagForgeCTF Unauthenticated Resource Modification/Deletion CVSS 3.1HIGH 8.6
TI-2026-17569 Flag Forge has ReDoS Vulnerability in User Profile Lookup API CVSS 3.1HIGH 7.5
TI-2025-37272 FlagForgeCTF Hint Exposure via API CVSS 3.1HIGH 7.5
TI-2025-37282 FlagForgeCTF Exposes User Emails via Public /api/user/[username] API CVSS 4.0MEDIUM 6.9

See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences