Vulnerability · Published Sep 27, 2025 · Assigned by GitHub_M
CVE-2025-59932FlagForgeCTF Unauthenticated Resource Modification/Deletion
High 8.6
In plain English
A high-severity improper access control in flagForge from FlagForgeCTF. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
Flag Forge is a Capture The Flag (CTF) platform. From versions 2.0.0 to before 2.3.1, the /api/resources endpoint previously allowed POST and DELETE requests without proper authentication or authorization. This could have enabled unauthorized users to create, modify, or delete resources on the platform. The issue has been fixed in FlagForge version 2.3.1.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| FlagForgeCTF | flagForge | >= 2.0.0, < 2.3.1 |
Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L