flagforge has 5 CVEs on record. The median CVSS is 8.6 (high), with 2 rated critical. None have a confirmed exploitation report.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 8.6
- Publish → KEV
- —
- Last 90 days
- 0 prev 0
Worst active — by depth score
CVE-2025-61777Critical· 9.4Flag Forge is a Capture The Flag (CTF) platform64CVE-2025-59841Critical· 9.8Flag Forge is a Capture The Flag (CTF) platform54CVE-2025-59932High· 8.6Flag Forge is a Capture The Flag (CTF) platform47CVE-2025-59826High· 7.6Flag Forge is a Capture The Flag (CTF) platform42CVE-2025-59843Medium· 5.3Flag Forge is a Capture The Flag (CTF) platform41
flagforge vulnerabilities
CVEs affecting flagforge, newest first. Open any entry for full detail, references, and exploit status.
5 CVEsRSS
CVE-2025-61777Critical· 9.4PoCFlag Forge is a Capture The Flag (CTF) platform
Flag Forge is a Capture The Flag (CTF) platform. Starting in version 2.0.0 and prior to version 2.3.2, the `/api/admin/badge-templates` (GET) and `/api/admin/badge-templates/create` (POST) endpoints previously allowed access without auth…
CVE-2025-59932High· 8.6Flag Forge is a Capture The Flag (CTF) platform
Flag Forge is a Capture The Flag (CTF) platform. From versions 2.0.0 to before 2.3.1, the /api/resources endpoint previously allowed POST and DELETE requests without proper authentication or authorization. This could have enabled unautho…
CVE-2025-59843Medium· 5.3PoCFlag Forge is a Capture The Flag (CTF) platform
Flag Forge is a Capture The Flag (CTF) platform. From versions 2.0.0 to before 2.3.2, the public endpoint /api/user/[username] returns user email addresses in its JSON response. The fix, intended for release in 2.3.1 but only available s…
CVE-2025-59841Critical· 9.8Flag Forge is a Capture The Flag (CTF) platform
Flag Forge is a Capture The Flag (CTF) platform. In versions from 2.2.0 to before 2.3.1, the FlagForge web application improperly handles session invalidation. Authenticated users can continue to access protected endpoints, such as /api/…
CVE-2025-59826High· 7.6Flag Forge is a Capture The Flag (CTF) platform
Flag Forge is a Capture The Flag (CTF) platform. In version 2.1.0, non-admin users can create arbitrary challenges, potentially introducing malicious, incorrect, or misleading content. This issue has been patched in version 2.2.0.