Critical severity · published Oct 6, 2025
CVE-2025-61777
FlagForge Allows Unauthenticated Badge Template API Access
9.1
CVSS
0.5%
EPSS
No
On KEV
Description
Flag Forge is a Capture The Flag (CTF) platform. Starting in version 2.0.0 and prior to version 2.3.2, the `/api/admin/badge-templates` (GET) and `/api/admin/badge-templates/create` (POST) endpoints previously allowed access without authentication or authorization. This could have enabled unauthorized users to retrieve all badge templates and sensitive metadata (createdBy, createdAt, updatedAt) and/or create arbitrary badge templates in the database. This could lead to data exposure, database pollution, or abuse of the badge system. The issue has been fixed in FlagForge v2.3.2. GET, POST, UPDATE, and DELETE endpoints now require authentication. Authorization checks ensure only admins can access and modify badge templates. No reliable workarounds are available.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 39% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FL
flagForge · FlagForgeCTF
>= 2.0.0, < 2.3.2 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-61777
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-61777
Patch
https://github.com/FlagForgeCTF/flagForge/commit/e2121c5fb7a512a49dcd875812c944265fb1a846
Vendor Advisory
https://github.com/FlagForgeCTF/flagForge/security/advisories/GHSA-26rx-c53q-rjf9
More from flagForge
9.8
CVE-2025-59841
FlagForgeCTF's Improper Session Handling Allows Access After Logout
9.8
CVE-2025-59827
FlagForgeCTF is Missing Authorization in main-v2
8.2
CVE-2025-59932
FlagForgeCTF Unauthenticated Resource Modification/Deletion
7.6
CVE-2025-59826
FlagForgeCTF Vulnerable to Unauthorized Problem Creation
7.5
CVE-2026-21868
Flag Forge has ReDoS Vulnerability in User Profile Lookup API