CVE-2026-121562 Details
Description
CTFd 3.1.0 before 3.8.7 contains an information disclosure vulnerability in the /api/v1/teams list endpoint that exposes non-public team custom field values. Unauthenticated attackers can paginate GET requests to collect hidden registration data such as emails, phone numbers, and student IDs when team mode and public visibility are enabled.
An information disclosure vulnerability has been identified in CTFd versions 3.1.0 prior to 3.8.7. The issue resides in the '/api/v1/teams' list endpoint, where non-public custom field values of teams are exposed. Unauthenticated attackers can paginate through GET requests to retrieve hidden registration information, such as emails, phone numbers, and student IDs, especially when team mode and public visibility are activated.
Users are advised to update CTFd to version 3.8.7 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| CTFd | >= 3.1.0, < 3.8.7 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 3, 2026 | New CVE Received | [email protected] |