CVE-2025-59932CWE-284broken-access-control

CVE-2025-59932

High · published September 27, 2025

CVSS v3.1
8.6
EPSS
0%
Percentile
29.4
In the wild
Unconfirmed
What it is

Flag Forge is a Capture The Flag (CTF) platform. From versions 2.0.0 to before 2.3.1, the /api/resources endpoint previously allowed POST and DELETE requests without proper authentication or authorization. This could have enabled unauthorized users to create, modify, or delete resources on the platform. The issue has been fixed in FlagForge version 2.3.1.

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00367 · 29.4th percentile
Weakness
CWE-284 · Improper Access Control
Published
2025-09-27T05:15Z
Affected products (1)
ProductVersionsFixed in
flagforge/flagforge≥ 2.0, < 2.3.12.3.1
References (1)
https://github.com/FlagForgeCTF/flagForge/security/advisories/GHSA-v8rh-25rf-gfqw · [email protected]
EPSS history
Timeline
  • 27 SEP 00:51Z
    FlagForgeCTF Unauthenticated Resource Modification/Deletion
    cvelistv5