CRITICAL🇵🇱 Wersja polska

CVE-2025-61777

CVSS 9.4v3.1pub. 2025-10-06upd. 2025-10-30

Flag Forge is a Capture The Flag (CTF) platform. Starting in version 2.0.0 and prior to version 2.3.2, the `/api/admin/badge-templates` (GET) and `/api/admin/badge-templates/create` (POST) endpoints previously allowed access without authentication or authorization. This could have enabled unauthorized users to retrieve all badge templates and sensitive metadata (createdBy, createdAt, updatedAt) and/or create arbitrary badge templates in the database. This could lead to data exposure, database pollution, or abuse of the badge system. The issue has been fixed in FlagForge v2.3.2. GET, POST, UPDATE, and DELETE endpoints now require authentication. Authorization checks ensure only admins can access and modify badge templates. No reliable workarounds are available.

🤖 AI Analysis
How it works

The endpoints `/api/admin/badge-templates` (GET) and `/api/admin/badge-templates/create` (POST) did not require any authentication or permission verification. An attacker could therefore send HTTP requests to these addresses without logging in and obtain a full list of badge templates along with metadata (fields createdBy, createdAt, updatedAt), as well as create arbitrary templates in the database. The absence of an access control mechanism (CWE-306) resulted in complete bypass of the security layer for these administrative resources.

Impact

An attacker can gain unauthorized access to sensitive platform metadata, contaminate the database with fake badge templates, and abuse the badge awarding system, which may disrupt the CTF platform's operation and compromise data integrity.

Mitigation & patch

Flagforge should be updated to version 2.3.2, in which all GET, POST, UPDATE, and DELETE endpoints require authentication, and authorization controls restrict access to badge templates exclusively to administrators. The vendor does not indicate any reliable workarounds for earlier versions.

Who is affected

Flagforge versions 2.0.0 to 2.3.1 (inclusive)

Analysis generated by Claude AI (Anthropic) based on NVD data. Always verify with vendor.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

  • Flagforge

    APP
    Flagforge
    2.0 – 2.3.2 (excl.)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2025-59841CRITICAL9.8PL ✓same product

FlagForge: nieprawidłowe unieważnianie sesji po wylogowaniu

CVE-2025-59827CRITICAL9.8PL ✓same product

Brak kontroli dostępu w Flag Forge — privilege escalation przez endpoint przypisywania odznak

CVE-2026-21868HIGH7.5same product

Flag Forge is a Capture The Flag (CTF) platform. Versions 2.3.2 and below have a Regular Expression Denial of ...

CVE-2025-59932HIGH8.6same product

Flag Forge is a Capture The Flag (CTF) platform. From versions 2.0.0 to before 2.3.1, the /api/resources endpo...

CVE-2025-59833HIGH7.5same product

Flag Forge is a Capture The Flag (CTF) platform. In versions from 2.1.0 to before 2.3.0, the API endpoint GET ...