FlagForgeCTF vulnerabilities
We track 7 vulnerabilities in FlagForgeCTF products. 7 are rated high or critical, and none are known to be exploited. The most recent was published on January 8, 2026.
Latest FlagForgeCTF vulnerabilities
- 7.5 High severity
flagForge: Inefficient Regular Expression Complexity
Flag Forge is a Capture The Flag (CTF) platform. Versions 2.3.2 and below have a Regular Expression Denial of Service (ReDoS) vulnerability in the user profile API endpoint (/api/user/[username]). The application constructs a regular expression dynamically usi
- 9.1 Critical severity
flagForge: Missing Authentication for Critical Functionality
Flag Forge is a Capture The Flag (CTF) platform. Starting in version 2.0.0 and prior to version 2.3.2, the `/api/admin/badge-templates` (GET) and `/api/admin/badge-templates/create` (POST) endpoints previously allowed access without authentication or authoriza
- 8.2 High severity
flagForge: Improper Access Control
Flag Forge is a Capture The Flag (CTF) platform. From versions 2.0.0 to before 2.3.1, the /api/resources endpoint previously allowed POST and DELETE requests without proper authentication or authorization. This could have enabled unauthorized users to create,
- 9.8 Critical severity
flagForge: Session Fixation
Flag Forge is a Capture The Flag (CTF) platform. In versions from 2.2.0 to before 2.3.1, the FlagForge web application improperly handles session invalidation. Authenticated users can continue to access protected endpoints, such as /api/profile, even after log
- 7.5 High severity
flagForge: Exposure of Sensitive Information to an Unauthorized Actor
Flag Forge is a Capture The Flag (CTF) platform. In versions from 2.1.0 to before 2.3.0, the API endpoint GET /api/problems/:id returns challenge hints in plaintext within the question object, regardless of whether the user has unlocked them via point deductio
- 9.8 Critical severity
flagForge: Missing Authorization
Flag Forge is a Capture The Flag (CTF) platform. In version 2.1.0, the /api/admin/assign-badge endpoint lacks proper access control, allowing any authenticated user to assign high-privilege badges (e.g., Staff) to themselves. This could lead to privilege escal
- 7.6 High severity
flagForge: Missing Authorization
Flag Forge is a Capture The Flag (CTF) platform. In version 2.1.0, non-admin users can create arbitrary challenges, potentially introducing malicious, incorrect, or misleading content. This issue has been patched in version 2.2.0.