CVE-2024-11716: medium-severity vulnerability in CTFd
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
A flaw in CTFd allows an authenticated user to change their team assignment during an ongoing competition, even though they should only be able to join a team once at registration. This breaks the fairness of the competition by letting players switch teams mid-event.
The vulnerability exists in CTFd 3.7.0–3.7.4 due to improper logic validation when resetting a user's bracket assignment. An authenticated user can trigger a bracket reset and reassign themselves to a different team mid-competition, bypassing the intended one-time-only team assignment constraint. This impacts competition integrity and fairness.
In the same product, most dangerous first.