CVE-2025-59843
📋 TL;DR
Flag Forge CTF platform versions 2.0.0 through 2.3.1 expose user email addresses through a public API endpoint. This vulnerability allows unauthenticated attackers to harvest email addresses of registered users. All users of affected versions are impacted by this privacy violation.
💻 Affected Systems
- Flag Forge CTF platform
📦 What is this software?
Flagforge by Flagforge
⚠️ Risk & Real-World Impact
Worst Case
Mass email harvesting leading to targeted phishing campaigns, spam lists, or identity correlation attacks against CTF participants.
Likely Case
Email addresses collected for spam lists or targeted phishing against CTF community members.
If Mitigated
Limited impact if email addresses are already public or disposable, but still violates privacy expectations.
🎯 Exploit Status
Exploitation requires only HTTP GET requests to the vulnerable endpoint. No authentication or special tools needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.3.2
Vendor Advisory: https://github.com/FlagForgeCTF/flagForge/security/advisories/GHSA-qqjv-8r5p-7xpj
Restart Required: No
Instructions:
1. Backup your Flag Forge instance. 2. Update to version 2.3.2 or later using your deployment method. 3. Verify the fix by checking that /api/user/[username] no longer returns email addresses.
🔧 Temporary Workarounds
No workarounds available
allThe vendor advisory states there are no workarounds for this vulnerability.
🧯 If You Can't Patch
- Implement web application firewall rules to block access to /api/user/* endpoints
- Monitor API logs for unusual patterns of requests to user endpoints
🔍 How to Verify
Check if Vulnerable:
Make a GET request to /api/user/[any_username] on your Flag Forge instance. If the JSON response contains an 'email' field with data, the system is vulnerable.Check Version:
Check the Flag Forge admin interface or deployment configuration for version information.Verify Fix Applied:
After updating to 2.3.2+, make the same GET request. The response should not contain email addresses in the JSON output.📡 Detection & Monitoring
Log Indicators:
- High volume of GET requests to /api/user/* endpoints
- Requests from unusual IP addresses to user API
Network Indicators:
- Patterns of sequential username enumeration in API requests
SIEM Query:
source="flagforge" AND uri_path="/api/user/*" AND http_method="GET" | stats count by src_ip