CVE-2025-59932

Flag Forge is a Capture The Flag (CTF) platform. From versions 2.0.0 to before 2.3.1, the /api/resources endpoint previously allowed POST and DELETE requests without proper authentication or authorization. This could have enabled unauthorized users to create, modify, or delete resources on the platform. The issue has been fixed in FlagForge version 2.3.1.

CVSS v3 8.6 HIGH

8.6^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact HIGH

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/FlagForgeCTF/flagForge/security/advisories/GHSA-v8rh-25rf-gfqw	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:flagforge:flagforge:*:*:*:*:*:*:*:*

History

09 Oct 2026, 10:10

Type	Values Removed	Values Added
Summary		(es) Flag Forge es una plataforma de Capture The Flag (CTF). Desde las versiones 2.0.0 hasta antes de la 2.3.1, el endpoint /api/resources permitía previamente solicitudes POST y DELETE sin la debida autenticación o autorización. Esto podría haber permitido a usuarios no autorizados crear, modificar o eliminar recursos en la plataforma. El problema ha sido solucionado en la versión 2.3.1 de FlagForge.

Information

Published : 2025-09-27 01:15

Updated : 2026-10-09 10:10

NVD link : CVE-2025-59932

Mitre link : CVE-2025-59932

CVE.ORG link : CVE-2025-59932

JSON object : View

Products Affected

flagforge

flagforge

CWE

CWE-284

Improper Access Control

{"id": "CVE-2025-59932", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-59932", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-29T14:13:38.258787Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 4.7, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.2, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "FlagForgeCTF", "product": "flagForge", "versions": [{"status": "affected", "version": ">= 2.0.0, < 2.3.1"}]}]}], "published": "2025-09-27T01:15:43.430", "references": [{"url": "https://github.com/FlagForgeCTF/flagForge/security/advisories/GHSA-v8rh-25rf-gfqw", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "Flag Forge is a Capture The Flag (CTF) platform. From versions 2.0.0 to before 2.3.1, the /api/resources endpoint previously allowed POST and DELETE requests without proper authentication or authorization. This could have enabled unauthorized users to create, modify, or delete resources on the platform. The issue has been fixed in FlagForge version 2.3.1."}, {"lang": "es", "value": "Flag Forge es una plataforma de Capture The Flag (CTF). Desde las versiones 2.0.0 hasta antes de la 2.3.1, el endpoint /api/resources permit\u00eda previamente solicitudes POST y DELETE sin la debida autenticaci\u00f3n o autorizaci\u00f3n. Esto podr\u00eda haber permitido a usuarios no autorizados crear, modificar o eliminar recursos en la plataforma. El problema ha sido solucionado en la versi\u00f3n 2.3.1 de FlagForge."}], "lastModified": "2026-10-09T10:10:00.193", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:flagforge:flagforge:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6D25E326-D145-4129-B470-6B2D2520E03E", "versionEndExcluding": "2.3.1", "versionStartIncluding": "2.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}