Read the docs
TI-2026-84368 Aliases CVE-2026-121562GHSA-qx4w-wvv4-8jv6

Information disclosure in CTFd team list API exposes hidden fields

Priority LOW 30CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-863.

Summary

CTFd from 3.1.0 before 3.8.7 has an incorrect authorization flaw (CWE-863) in the /api/v1/teams list endpoint that exposes non-public team custom field values. An unauthenticated remote attacker can page through GET requests to collect hidden registration data such as emails, phone numbers, and student IDs when team mode and public visibility are enabled.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Description from the CNA

CTFd 3.1.0 before 3.8.7 contains an information disclosure vulnerability in the /api/v1/teams list endpoint that exposes non-public team custom field values. Unauthenticated attackers can paginate GET requests to collect hidden registration data such as emails, phone numbers, and student IDs when team mode and public visibility are enabled.

Why it matters now

EPSS 0.00326 25th percentileScored 2026-11-07
Fix Fixed CTFd (CTFd): 3.8.7

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
CTFdCTFd3.1.0 to before 3.8.73.8.7Patch availableCNA
  • CTFd VendorCTFd Affected 3.1.0 to before 3.8.7 Fixed in 3.8.7 Patch available CNA

Remediation

Update CTFd to version 3.8.7, the fixed version for the affected range from 3.1.0 before 3.8.7.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

  • Fix · CNA CTFd (CTFd) Fixed in 3.8.7

Timeline

  1. 2026-11-03 Threatist record created from CVE-2026-121562
  2. 2026-11-03 Alias added: GHSA-qx4w-wvv4-8jv6
  3. 2026-11-05 Priority changed: MEDIUM → LOW

References

Patch 1

Other 5

  • TI-2024-10863 Tokens in CTFd used for account activation and password resetting can be used… CVSS 4.0MEDIUM 6.3
  • TI-2024-10862 While assignment of a user to a team (bracket) in CTFd should be possible only once, at… CVSS 4.0MEDIUM 5.3
  • TI-2020-05852 Incorrect username validation in the registration process of CTFd v2.0.0 - v2.2.2 allows… CVSS 3.1CRITICAL 9.8
  • TI-2020-04346 session fixation in rCTF CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences