CVE-2025-61777: critical vulnerability in FlagForgeCTF flagForge
FlagForge Allows Unauthenticated Badge Template API Access
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.4epss 0.5%
Flag Forge is a Capture The Flag (CTF) platform. Starting in version 2.0.0 and prior to version 2.3.2, the `/api/admin/badge-templates` (GET) and `/api/admin/badge-templates/create` (POST) endpoints previously allowed access without authentication or authorization. This could have enabled unauthorized users to retrieve all badge templates and sensitive metadata (createdBy, createdAt, updatedAt) and/or create arbitrary badge templates in the database. This could lead to data exposure, database pollution, or abuse of the badge system. The issue has been fixed in FlagForge v2.3.2. GET, POST, UPDATE, and DELETE endpoints now require authentication. Authorization checks ensure only admins can access and modify badge templates. No reliable workarounds are available.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Affected products
FlagForgeCTF · flagForgeRelated CVEs — FlagForgeCTF flagForge
In the same product, most dangerous first.
CVE-2025-59843MEDIUMFlagForgeCTF Exposes User Emails via Public /api/user/[username] APIEPSS 0.4%CVE-2025-59841CRITICALFlagForgeCTF's Improper Session Handling Allows Access After LogoutEPSS 0.4%CVE-2025-59827HIGHFlagForgeCTF is Missing Authorization in main-v2EPSS 0.4%CVE-2025-59932HIGHFlagForgeCTF Unauthenticated Resource Modification/DeletionEPSS 0.4%CVE-2025-59833HIGHFlagForgeCTF Hint Exposure via APIEPSS 0.3%CVE-2026-21868HIGHFlag Forge has ReDoS Vulnerability in User Profile Lookup APIEPSS 0.3%