CVE-2025-61777 Details
Description
Flag Forge is a Capture The Flag (CTF) platform. Starting in version 2.0.0 and prior to version 2.3.2, the `/api/admin/badge-templates` (GET) and `/api/admin/badge-templates/create` (POST) endpoints previously allowed access without authentication or authorization. This could have enabled unauthorized users to retrieve all badge templates and sensitive metadata (createdBy, createdAt, updatedAt) and/or create arbitrary badge templates in the database. This could lead to data exposure, database pollution, or abuse of the badge system. The issue has been fixed in FlagForge v2.3.2. GET, POST, UPDATE, and DELETE endpoints now require authentication. Authorization checks ensure only admins can access and modify badge templates. No reliable workarounds are available.
A broken access control vulnerability has been identified in Flag Forge versions 2.0.0 prior to 2.3.2. The issue resides in the '/api/admin/badge-templates' (GET) and '/api/admin/badge-templates/create' (POST) endpoints, which previously allowed unauthenticated access. This vulnerability could have enabled unauthorized users to retrieve all badge templates along with sensitive metadata such as 'createdBy', 'createdAt', and 'updatedAt', or to create arbitrary badge templates in the database. The consequences of this vulnerability include data exposure, database pollution, and potential abuse of the badge system.
Users are advised to update to Flag Forge version 2.3.2 or later. Instructions for updating can be found in the Flag Forge GitHub repository.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Oct 6, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
| CWE-284 | Improper Access Control | [email protected] |
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| flagforge flagforge | >= 2.0, < 2.3.2 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Oct 30, 2025 | Initial Analysis | [email protected] |
| Oct 6, 2025 | New CVE Received | [email protected] |