Vulnerability · Published Nov 3, 2026 · Assigned by VulnCheck
CVE-2026-121562CTFd 3.1.0 before 3.8.7 Information Disclosure via /api/v1/teams Endpoint
Medium 5.3
In plain English
A medium-severity incorrect authorization in CTFd from CTFd. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.3%top 74.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
CTFd 3.1.0 before 3.8.7 contains an information disclosure vulnerability in the /api/v1/teams list endpoint that exposes non-public team custom field values. Unauthenticated attackers can paginate GET requests to collect hidden registration data such as emails, phone numbers, and student IDs when team mode and public visibility are enabled.
Affected products (as reported)
Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References
- Patch Commit patch
- https://github.com/CTFd/CTFd product
- https://github.com/CTFd/CTFd/blob/3.8.6/CTFd/api/v1/teams.py#L128-L131 technical-description
- https://github.com/CTFd/CTFd/blob/3.8.6/CTFd/schemas/teams.py#L336-L363 technical-description
- https://blog.ctfd.io/ctfd-3-8-7/ technical-description
- CTFd 3.8.7 Release Notes technical-description, release-notes
- VulnCheck Advisory: CTFd 3.1.0 before 3.8.7 Information Disclosure via /api/v1/teams Endpoint third-party-advisory