CVE-2025-61777

CVE-2025-61777 1. Unbefugte Änderung von Badge-Vorlagen auf FlagforgeCTF CVE-2025-61777 Zusammenfassung Die Flagforge-Anwendung https://flagforge.xyz weist kritische Schwachstellen in ihren administrativen API-Endpunkten auf, insbesondere /api/admin/badge-templates GET und...

CVE-2025-59843-CVE-2025-59932

CVE-2025-59843 & CVE-2025-59932 1. Esposizione Pubblica degli Indirizzi Email degli Utenti CVE-2025-59843 Ambito / Applicazione Interessata: FlagForge Web Application Endpoint API: /api/user/username Dettagli: L'endpoint restituisce gli indirizzi email degli utenti senza autenticazione. Qualsiasi...

CVE-2025-61777 FlagForge Allows Unauthenticated Badge Template API Access

Flag Forge is a Capture The Flag CTF platform. Starting in version 2.0.0 and prior to version 2.3.2, the /api/admin/badge-templates GET and /api/admin/badge-templates/create POST endpoints previously allowed access without authentication or authorization. This could have enabled unauthorized user...

CVE-2025-59843

Flag Forge is a Capture The Flag CTF platform. From versions 2.0.0 to before 2.3.2, the public endpoint /api/user/username returns user email addresses in its JSON response. The fix, intended for release in 2.3.1 but only available starting in version 2.3.2, removes email addresses from public AP...

CVE-2025-59841 FlagForgeCTF's Improper Session Handling Allows Access After Logout

Flag Forge is a Capture The Flag CTF platform. In versions from 2.2.0 to before 2.3.1, the FlagForge web application improperly handles session invalidation. Authenticated users can continue to access protected endpoints, such as /api/profile, even after logging out. CSRF tokens are also still...