---
id: CVE-2026-121562
title: CTFd 3.1.0 before 3.8.7 Information Disclosure via /api/v1/teams Endpoint
summary: >-
  CTFd 3.1.0 before 3.8.7 contains an information disclosure vulnerability in
  the /api/v1/teams list endpoint that exposes non-public team custom field
  values. Unauthenticated attackers can paginate GET requests to collect hidden
  registrat…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-863
vendor: CTFd
product: CTFd
affected:
  - CTFd >= 3.1.0 < 3.8.7
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T15:17:17.803Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-121562'
references:
  - url: >-
      https://github.com/CTFd/CTFd/commit/122c224030224ca6a04d2928280055a84bbd4850
    label: Patch Commit
  - url: 'https://github.com/CTFd/CTFd'
  - url: 'https://github.com/CTFd/CTFd/blob/3.8.6/CTFd/api/v1/teams.py#L128-L131'
  - url: 'https://github.com/CTFd/CTFd/blob/3.8.6/CTFd/schemas/teams.py#L336-L363'
  - url: 'https://blog.ctfd.io/ctfd-3-8-7/'
  - url: 'https://github.com/CTFd/CTFd/releases/tag/3.8.7'
    label: CTFd 3.8.7 Release Notes
  - url: >-
      https://www.vulncheck.com/advisories/ctfd-3.1.0-before-3.8.7-information-disclosure-via-api-v1-teams-endpoint
    label: >-
      VulnCheck Advisory: CTFd 3.1.0 before 3.8.7 Information Disclosure via
      /api/v1/teams Endpoint
tags:
  - cve.org
epss: 0.00326
epssPercentile: 0.25821
ingestedAt: '2026-11-05T19:30:42.980Z'
---

## Overview

CTFd 3.1.0 before 3.8.7 contains an information disclosure vulnerability in the /api/v1/teams list endpoint that exposes non-public team custom field values. Unauthenticated attackers can paginate GET requests to collect hidden registration data such as emails, phone numbers, and student IDs when team mode and public visibility are enabled.

## Affected

- `CTFd >= 3.1.0 < 3.8.7`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.