flagforge vulnerabilities
CVEs whose affected-version data names the flagforge package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
3 CVEsRSS
CVE-2025-61777Critical· 9.4PoCFlag Forge is a Capture The Flag (CTF) platform
Flag Forge is a Capture The Flag (CTF) platform. Starting in version 2.0.0 and prior to version 2.3.2, the `/api/admin/badge-templates` (GET) and `/api/admin/badge-templates/create` (POST) endpoints previously allowed access without auth…
CVE-2025-59932High· 8.6Flag Forge is a Capture The Flag (CTF) platform
Flag Forge is a Capture The Flag (CTF) platform. From versions 2.0.0 to before 2.3.1, the /api/resources endpoint previously allowed POST and DELETE requests without proper authentication or authorization. This could have enabled unautho…
CVE-2025-59843Medium· 5.3PoCFlag Forge is a Capture The Flag (CTF) platform
Flag Forge is a Capture The Flag (CTF) platform. From versions 2.0.0 to before 2.3.2, the public endpoint /api/user/[username] returns user email addresses in its JSON response. The fix, intended for release in 2.3.1 but only available s…