---
id: CVE-2025-61777
title: Flag Forge is a Capture The Flag (CTF) platform
summary: >-
  Flag Forge is a Capture The Flag (CTF) platform. Starting in version 2.0.0 and
  prior to version 2.3.2, the `/api/admin/badge-templates` (GET) and
  `/api/admin/badge-templates/create` (POST) endpoints previously allowed access
  without auth…
severity: critical
cvss: 9.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L'
cwe:
  - CWE-200
  - CWE-284
  - CWE-306
  - CWE-306
vendor: flagforge
product: flagforge
affected:
  - 'flagforge >= 2.0, < 2.3.2'
patched:
  - flagforge 2.3.2
published: '2025-10-06'
updated: '2026-10-09'
sourceUpdated: '2026-10-09T10:10:00.193'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-61777'
references:
  - url: >-
      https://github.com/FlagForgeCTF/flagForge/commit/e2121c5fb7a512a49dcd875812c944265fb1a846
    label: security-advisories@github.com
  - url: >-
      https://github.com/FlagForgeCTF/flagForge/security/advisories/GHSA-26rx-c53q-rjf9
    label: security-advisories@github.com
tags:
  - nvd
  - exploit-available
epss: 0.00451
epssPercentile: 0.3898
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/0x0w1z/CVE-2025-61777'
  checkedAt: '2026-10-27T16:48:09.423Z'
exploitAvailable: true
ingestedAt: '2026-10-09T12:53:28.921Z'
---

## Overview

Flag Forge is a Capture The Flag (CTF) platform. Starting in version 2.0.0 and prior to version 2.3.2, the `/api/admin/badge-templates` (GET) and `/api/admin/badge-templates/create` (POST) endpoints previously allowed access without authentication or authorization. This could have enabled unauthorized users to retrieve all badge templates and sensitive metadata (createdBy, createdAt, updatedAt) and/or create arbitrary badge templates in the database. This could lead to data exposure, database pollution, or abuse of the badge system. The issue has been fixed in FlagForge v2.3.2. GET, POST, UPDATE, and DELETE endpoints now require authentication. Authorization checks ensure only admins can access and modify badge templates. No reliable workarounds are available.

## Affected

- `flagforge >= 2.0, < 2.3.2`

## Remediation

Upgrade past the affected range:

- `flagforge 2.3.2`