CVE-2025-59826

Flag Forge is a Capture The Flag (CTF) platform. In version 2.1.0, non-admin users can create arbitrary challenges, potentially introducing malicious, incorrect, or misleading content. This issue has been patched in version 2.2.0.

CVSS v3 7.6 HIGH

7.6^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact HIGH

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/FlagForgeCTF/flagForge/security/advisories/GHSA-q7pg-qchv-3pc5	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:flagforge:flagforge:2.1.0:*:*:*:*:*:*:*

History

11 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Flag Forge es una plataforma de Capture The Flag (CTF). En la versión 2.1.0, los usuarios no administradores pueden crear desafíos arbitrarios, introduciendo potencialmente contenido malicioso, incorrecto o engañoso. Este problema ha sido parcheado en la versión 2.2.0.

Information

Published : 2025-09-23 21:15

Updated : 2026-10-11 20:10

NVD link : CVE-2025-59826

Mitre link : CVE-2025-59826

CVE.ORG link : CVE-2025-59826

JSON object : View

Products Affected

flagforge

flagforge

CWE

CWE-862

Missing Authorization

{"id": "CVE-2025-59826", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-59826", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-24T13:22:46.470488Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 4.7, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "FlagForgeCTF", "product": "flagForge", "versions": [{"status": "affected", "version": "= 2.1.0"}]}]}], "published": "2025-09-23T21:15:52.700", "references": [{"url": "https://github.com/FlagForgeCTF/flagForge/security/advisories/GHSA-q7pg-qchv-3pc5", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "Flag Forge is a Capture The Flag (CTF) platform. In version 2.1.0, non-admin users can create arbitrary challenges, potentially introducing malicious, incorrect, or misleading content. This issue has been patched in version 2.2.0."}, {"lang": "es", "value": "Flag Forge es una plataforma de Capture The Flag (CTF). En la versi\u00f3n 2.1.0, los usuarios no administradores pueden crear desaf\u00edos arbitrarios, introduciendo potencialmente contenido malicioso, incorrecto o enga\u00f1oso. Este problema ha sido parcheado en la versi\u00f3n 2.2.0."}], "lastModified": "2026-10-11T20:10:00.200", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:flagforge:flagforge:2.1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B503F5EE-F387-40C7-B4C9-4B1018D64508"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}