PT-2025-39352

CVE-2025-59833

Published

2025-09-24

Updated

2025-10-08

Description by

CVSS 3.1

7.5

High

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Flag Forge versions 2.1.0 through 2.2.9

Description Flag Forge is a Capture The Flag (CTF) platform. The API endpoint GET /api/problems/:id returns challenge hints in plaintext within the question object, regardless of whether the user has unlocked them. This allows users to view all hints for free, undermining the platform’s business logic and reducing the integrity of the challenge system. The vulnerable parameter is id.

Recommendations Update to version 2.3.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Related identifiers

CVE-2025-59833