CVE-2026-121562 CTFd 3.1.0 before 3.8.7 Information Disclosure via /api/v1/teams Endpoint

CTFd 3.1.0 before 3.8.7 contains an information disclosure vulnerability in the /api/v1/teams list endpoint that exposes non-public team custom field values. Unauthenticated attackers can paginate GET requests to collect hidden registration data such as emails, phone numbers, and student IDs when...