Vulnerability record · CVE-2025-61777 · published 6 October 2025

CVE-2025-61777: Flagforge information exposure vulnerability

Flagforge · Flagforge

Flag Forge is a Capture The Flag (CTF) platform. Starting in version 2.0.0 and prior to version 2.3.2, the `/api/admin/badge-templates` (GET) and `/api/admin/badge-templates/create` (POST) endpoints previously allowed access without authentication or authorization. This could have enabled unauthorized users to retrieve all badge templates and sensitive metadata (createdBy, createdAt, updatedAt) and/or create arbitrary badge templates in the database. This could lead to data exposure, database pollution, or abuse of the badge system. The issue has been fixed in FlagForge v2.3.2. GET, POST, UPDATE, and DELETE endpoints now require authentication. Authorization checks ensure only admins can access and modify badge templates. No reliable workarounds are available.

9.1 CVSS 3.1 Critical EPSS 0.45% · top 63.3% CWE-200 · Information exposureCWE-284 · Improper access control

9.1CVSS 3.1 base score

0.45%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

2References

17 Jun 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Flagforge Flagforge

References

Link	Tags
https://github.com/FlagForgeCTF/flagForge/commit/e2121c5fb7a512a49dcd875812c944265fb1a846	Patch
https://github.com/FlagForgeCTF/flagForge/security/advisories/GHSA-26rx-c53q-rjf9	Vendor Advisory

Track CVE-2025-61777 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2025-59841Flagforge insufficient session expiration vulnerabilityFlag Forge is a Capture The Flag (CTF) platform. In versions from 2.2.0 to before 2.3.1, the FlagForge web application improperly handles session inv…EPSS 0.42%25 Sep 2025 9.8CVE-2025-59827Flagforge missing authorization vulnerabilityFlag Forge is a Capture The Flag (CTF) platform. In version 2.1.0, the /api/admin/assign-badge endpoint lacks proper access control, allowing any aut…EPSS 0.37%24 Sep 2025 8.2CVE-2025-59932Flagforge improper access control vulnerabilityFlag Forge is a Capture The Flag (CTF) platform. From versions 2.0.0 to before 2.3.1, the /api/resources endpoint previously allowed POST and DELETE …EPSS 0.37%27 Sep 2025 7.6CVE-2025-59826Flagforge missing authorization vulnerabilityFlag Forge is a Capture The Flag (CTF) platform. In version 2.1.0, non-admin users can create arbitrary challenges, potentially introducing malicious…EPSS 0.23%23 Sep 2025 7.5CVE-2026-21868Flagforge inefficient regular expression (redos) vulnerabilityFlag Forge is a Capture The Flag (CTF) platform. Versions 2.3.2 and below have a Regular Expression Denial of Service (ReDoS) vulnerability in the us…EPSS 0.31%8 Jan 2026 7.5CVE-2025-59833Flagforge information exposure vulnerabilityFlag Forge is a Capture The Flag (CTF) platform. In versions from 2.1.0 to before 2.3.0, the API endpoint GET /api/problems/:id returns challenge hin…EPSS 0.35%24 Sep 2025 6.9CVE-2025-59843Flagforge vulnerabilityFlag Forge is a Capture The Flag (CTF) platform. From versions 2.0.0 to before 2.3.2, the public endpoint /api/user/[username] returns user email add…EPSS 0.41%26 Sep 2025 5.9CVE-2025-68686FortiOS symbolic link patch bypass exposes sensitive informationFortiOS contains an information exposure flaw (CWE-200) that lets a remote unauthenticated attacker bypass the patch for the symbolic link persistenc…KEVEPSS 30%analysed10 Feb 2026

Source: NIST National Vulnerability Database (record CVE-2025-61777), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.