CVE-2026-121562mediumCWE-863

CVE-2026-121562: medium-severity vulnerability in CTFd

CTFd 3.1.0 before 3.8.7 Information Disclosure via /api/v1/teams Endpoint

Published

Follow this CVE+ Monitor CTFd

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.9epss 0.3%
CTFd 3.1.0 before 3.8.7 contains an information disclosure vulnerability in the /api/v1/teams list endpoint that exposes non-public team custom field values. Unauthenticated attackers can paginate GET requests to collect hidden registration data such as emails, phone numbers, and student IDs when team mode and public visibility are enabled.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
CTFd · CTFd
Related CVEs — CTFd

In the same product, most dangerous first.

CVE-2024-11716MEDIUMCVE-2024-11716EPSS 11.6%CVE-2024-11717MEDIUMCVE-2024-11717EPSS 0.7%