PT-2026-136236

CVE-2026-121562

Published

2026-11-03

Updated

2026-11-03

Description by

CVSS 4.0

6.9

Medium

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions CTFd versions 3.1.0 through 3.8.6

Description An information disclosure issue exists in the '/api/v1/teams' endpoint. Unauthenticated attackers can use paginated GET requests to retrieve non-public team custom field values, such as emails, phone numbers, and student IDs, provided that team mode and public visibility are enabled.

Recommendations Update CTFd to version 3.8.7 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Coldheat

Oceanwarranty

Vendors

Affected products

Weakness enumeration

CWE-863: Incorrect Authorization