CVE-2025-59843-CVE-2025-59932

CVE-2025-59843 & CVE-2025-59932 1. ユーザーメールアドレスの公開露出 CVE-2025-59843 対象 / 影響を受けるアプリケーション: FlagForge Web Application APIエンドポイント: /api/user/username 詳細: このエンドポイントは認証なしでユーザーのメールアドレスを返します。任意のユーザー名を公開クエリできます。 根本原因 / コード参照: const user = await UserSchema.findOne name: $regex: new RegExp^$username$, 'i'...

CVE-2025-61777

CVE-2025-61777 1. 在 FlagforgeCTF 上未经授权修改徽章模板 CVE-2025-61777 摘要 Flagforge 应用程序（https://flagforge.xyz）在其管理 API 端点中暴露了严重漏洞，具体为 /api/admin/badge-templates（GET）和 /api/admin/badge-templates/create（POST）。这两个端点均缺少身份验证和授权控制，允许未经身份验证的用户检索敏感的徽章模板数据，并在 MongoDB...

CVE-2025-61777 FlagForge Allows Unauthenticated Badge Template API Access

Flag Forge is a Capture The Flag CTF platform. Starting in version 2.0.0 and prior to version 2.3.2, the /api/admin/badge-templates GET and /api/admin/badge-templates/create POST endpoints previously allowed access without authentication or authorization. This could have enabled unauthorized user...

CVE-2025-59843

Flag Forge is a Capture The Flag CTF platform. From versions 2.0.0 to before 2.3.2, the public endpoint /api/user/username returns user email addresses in its JSON response. The fix, intended for release in 2.3.1 but only available starting in version 2.3.2, removes email addresses from public AP...

CVE-2025-59841 FlagForgeCTF's Improper Session Handling Allows Access After Logout

Flag Forge is a Capture The Flag CTF platform. In versions from 2.2.0 to before 2.3.1, the FlagForge web application improperly handles session invalidation. Authenticated users can continue to access protected endpoints, such as /api/profile, even after logging out. CSRF tokens are also still...