CVE-2025-59833

Flag Forge is a Capture The Flag CTF platform. In versions from 2.1.0 to before 2.3.0, the API endpoint GET /api/problems/:id returns challenge hints in plaintext within the question object, regardless of whether the user has unlocked them via point deduction. Users can view all hints for free,...

CVE-2025-59833

Flag Forge CTI platform vulnerable versions 2.1.0–2.2.9 expose hints in plaintext within the GET /api/problems/:id response, revealing unreleased hints regardless of deduction. This information disclosure undermines business logic and challenge integrity. The issue is patched in version 2.3.0. Re...