Access Control Issue in Flag Forge CTF Platform

CVE-2025-59827

What is CVE-2025-59827?

Flag Forge, a popular Capture The Flag (CTF) platform, contains an access control vulnerability in version 2.1.0 that affects the /api/admin/assign-badge endpoint. This weakness allows any authenticated user to assign themselves high-privilege badges, such as Staff, without proper authorization. Such functionality could lead to privilege escalation and potentially allow users to impersonate administrative roles, compromising the integrity and security of the platform. This vulnerability has been addressed in version 2.2.0.

References