CVE-2025-59843mediumCWE-359

CVE-2025-59843: falha de média gravidade em FlagForgeCTF flagForge

FlagForgeCTF Exposes User Emails via Public /api/user/[username] API

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar flagForge

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.9epss 0.4%
Flag Forge is a Capture The Flag (CTF) platform. From versions 2.0.0 to before 2.3.2, the public endpoint /api/user/[username] returns user email addresses in its JSON response. The fix, intended for release in 2.3.1 but only available starting in version 2.3.2, removes email addresses from public API responses while keeping the endpoint publicly accessible. Users should upgrade to version 2.3.2 or later to eliminate exposure. There are no workarounds for this vulnerability.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
Produtos afetados
FlagForgeCTF · flagForge
CVEs relacionadas — FlagForgeCTF flagForge

No mesmo produto, das mais perigosas para as menos.

CVE-2025-61777CRITICALFlagForge Allows Unauthenticated Badge Template API AccessEPSS 0.5%CVE-2025-59841CRITICALFlagForgeCTF's Improper Session Handling Allows Access After LogoutEPSS 0.4%CVE-2025-59827HIGHFlagForgeCTF is Missing Authorization in main-v2EPSS 0.4%CVE-2025-59932HIGHFlagForgeCTF Unauthenticated Resource Modification/DeletionEPSS 0.4%CVE-2025-59833HIGHFlagForgeCTF Hint Exposure via APIEPSS 0.3%CVE-2026-21868HIGHFlag Forge has ReDoS Vulnerability in User Profile Lookup APIEPSS 0.3%