CVEvulnerability

CVE-2025-59932

8.2 HIGH Published 2025-09-27 Modified 2026-10-09 Official page ↗
Status
Analyzed
Published
2025-09-27
Last modified
2026-10-09
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.6 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
CVSS 3.1 ([email protected])
8.2 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
Weaknesses
CWE-284

Description

Flag Forge is a Capture The Flag (CTF) platform. From versions 2.0.0 to before 2.3.1, the /api/resources endpoint previously allowed POST and DELETE requests without proper authentication or authorization. This could have enabled unauthorized users to create, modify, or delete resources on the platform. The issue has been fixed in FlagForge version 2.3.1.

Affected configurations

• flagforge flagforge (>= 2.0 < 2.3.1)

Related

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References